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thu  data  was  analyzed  to  determine  the  Type  I and  II  error  rates  for  identity 
verification.  A Type  I error  is  a failure  to  recognize  a legitimate  subject, 
whereas  a Type  II  error  occurs  when  an  imposter  Is  identified  as  a legitimate 
subject.  Results  were  quite  encouraging.  TTie  handprint  achieved  a Type  I error 
of  1.4  percent  and  a Type  II  of  1.6  percent.  The  C-trace  performed  at  a Type  I 
of  1.2  percent  and  a Type  II  of  1 . 1 'percenC.  Arguments  which  indicate  that  the 
handprint  results  can  be  improved  significantly  and  the  C-trace  moderately  are 
given. 
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EVALUATION 


This  exploratory  development  program  investigated  In 
detail  those  personal  attributes  which  offer  a potential 
to  automatic  identity  of  an  Individual  for  access  control 
functions.  The  Initial  phases  of  this  program  were  to 
find  physical  attributes  that  were  unique  to  an  Individual 
and  could  be  effectively  automated  with  today's  technology. 
This  program  was  a natural  outgrowth  of  RAOC's  successful 
automatic  Speaker  Verification  System  for  access  control 
and  RADC's  expertise  In  signal  processing  systems  such  as 
OLPARS. 

Of  the  over  thirty  attributes  studied,  two  were  selected 
for  detailed,  in  depth  experimental  Investigation.  Both  of 
the  attributes  were  found  to  meet  existing  entry  control 
specifications.  Hence,  it  Is  recommended  that  continued  sup- 
port be  given  In  the  operational  realization  of  these  attrib- 
utes for  future  generation  entry  control  systems. 


BRUNO  BEEK 
Project  Engineer 


SKCTION  1 


INTRODUCTION 


1.1.  EXECUTIVE  SUMMARY 


Eron  the  aboriginal  native  who  covers  his  body  with  tribal  and  individual 
tattoos  to  the  astronaut  disembarking  at  a space  station  to  register  in  a 
voice  recognition  booth  in  2001,  A Space  Odyssey,  man  has  sought,  in  fact  or 
in  fiction,  the  means  to  identify  individual  members  of  his  race.  Arthur 
Clarke's  vision  of  the  future  in  2001  is,  like  much  of  the  better  science 
fiction,  based  on  fact.  The  technology  necessary  for  automatic  voice  recog- 
nition has  been  pursued  for  some  time  and  is  currently  the  personal  identity 
mechanism  which  is  to  be  incorporated  into  the  Air  Force  Base  and  Installation 
Security  System  (BISS).  A speaker  verification  system  has  been  developed  by 
Texas  Instruments  which  is  able  to  meet  the  lowest  level  of  BISS  specifica- 
tions, error  rates  near  one  per  cent. 

The  Rome  Air  Development  Center  (RADC)  has  sponsored  a considerable 
portion  of  the  speaker  verification  work.  Recently,  however,  this  agency  has 
begun  to  consider  alternative  means  of  identity  verification  and  has,  as  a 
result,  funded  a modest  investigation  by  Pattern  Analysis  and  Recognition 
Corporation  (PAR).  This  document  constitutes  a final  report  on  the  effort. 
Contract  #r30602-76-C-0368 . 
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Thttre  are  nany  reasons  for  pursuing  alternate  means  of  identity  verifica- 
tion. first  of  all,  the  one  per  cent  error  rate  is  only  the  lowest  level  cf 
BISS  specifications.  At  the  highest  level  of  security,  one  would  live  to 
achieve  error  rates  as  low  as  one  part  in  a million.  It  is  by  no  means 
certain  that  voice  recognition  can  attain  this  goal.  One  hope  is  that  some 
new  attribute  night  meet  the  more  stringent  specifications.  Additionally, 
there  is  always  the  possibility  that  smaller  error  rates  can  be  gained  by 
combining  speaker  recognition  with  some  other  attribute,  one  perhaps  to 
emerge  from  the  PAR  investigation.  Another  motive  for  seeking  additional 
means  of  identity  verification  is  that  voice  recognition  may  not  always  be  the 
best  technology  for  every  application.  It  may  sometimes  be  too  costly,  or 
too  slow,  or,  perhaps,  too  difficult  to  use. 

Let  us  digress  for  a moment  to  make  more  precise  two  ideas  which  we  have 
so  far  been  using  interchangeably,  "identification"  and  "verification." 
Identification  is  to  label  an  unknown  individual  of  a population,  whereas 
verification  is  to  ascertain  whether  a labeled  individual  of  a population  is 
correctly  labeled.  Identification  is  the  domain  of  forensics.  Verification 
is  what  is  demanded  in  most  security  systems  for  access  control.  Thus,  an 
individual  presenting  himself  for  entry  is  assumed  to  cue  the  system  by 
entering  his  name  or  code.  The  system  simply  verifies  that  the  personal 
attribute  being  measured  for  that  person  agrees  with  the  value  already  on 
file.  The  verification  problem  is  obviously  simpler,  since  any  system  which 
can  perform  identification  can,  a fortiori , perform  verification. 
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PAR  undertook  three  tasks  for  RADC.  First,  we  were  to  perform  a general 
study  of  alternate  means  of  identification.  From  a list  of  candidate  personal 
attributes,  we  were  to  single  out  two  especially  promising  techniques  for  in- 
depth  investigation.  For  the  two  personal  attributes  selected  under  the  first 
task,  PAR  was  to  collect  data  on  72  peoole  at  three  sessions  over  a period  of 
three  months.  The  final  task  was  to  use  this  data  to  determine  the  error 
rates  for  each  of  the  two  attributes. 

The  attributes  listed  in  Table  1-1  were  selected  by  PAP  for  evaluation. 
Sources  for  these  attributes  included  RADC  suggestions,  books  on  forensics, 
medical  and  physiological  literature,  and  the  imagination  of  the  staff. 

The  various  physical  attributes  were  evaluated  for  utility  in  a verifi- 
cation system  by  assigning  numerical  ratings  to  them  in  six  categories.  The 
categories  for  evaluation  are  listed  in  Table  1-2.  "Separability"  means  the 
error  rate  of  the  technique.  For  verification  systems,  the  errors  are  labeled 
Type  I,  a "sin  of  omission,"  the  probability  that  a legitimate  applicant  will 
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"i  ii'le  i-1  1 pi'uonal  Attributes  Considered  Tor  Identification 


1.  ralv.i  print  (lines  and/or  ridges)  and  footprints 
. . folds 

rir.y^r  lengths,  hand  area 
SVin  color,  hair  color,  eye  color 
5.  Vein  pattern 
f> . Photoplethysmogram 

7.  Skin  resistance 

8.  Total  (body)  resistance 

9.  Bone  pattern  (ultrasound) 

10.  Finger  tremor  pattern 

11.  IR  radiation  pattern 

12.  Eye  scan  path/dilation 

13.  Sonic  characteristics  of  the  teeth/skull 

14.  Bite  patterns/fillings 

15.  Ear  structure 

16.  Electroencephalograms 

17.  Visually  evoked  potentials  of  the  brain 

18.  Visually  evoked  magnetic  fields  of  the  brain 

19.  Saliva 

20.  Blood  composition 

21.  Odor/sweat 

22.  Height/weight 
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23. 


Gait 


i 

i 

i 


24.  Electrocardiogram  (ECG,  DCG,  Echocardiogram) 

25.  Ballistocardiogram 

26.  Verbal  response  pattern 

27.  Personal  history 

28.  Typing  style 

29.  Lip  grooves 

30.  Polygraph 

31.  Implanted  marks 

32.  Body  vibration  transfer  function 

33.  Nail  grooves 


Table 

[ 
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(Continued) 


1 

I 
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Table  1-2 


Evaluation  Criteria  for  Personal  Attributes 


eparability 

Acceptability 

!'easibility 

Cost 

Speed 

Penetrability  - 


Handprint 

I .014 

II  .0164 


Type  I and  II  Error  performance 
User  acceptance 
Technological  risk 

Development,  production  and  operating. 
Time  for  user  to  p.ain  access 
Ease  of  access  by  a trained  agent 


Table  1-3  Error  Rates 


C-Trace 


.0122 

.0107 


1-6 


be  rejected  by  the  system,  and  Type  II,  a "sin  of  commission,"  the  probability 
that  an  illegitimate  applicant  will  be  accepted.  The  latter  is  assumed  to  be 


only  a casual  intruder  and  not  a trained  agent.  To  evaluate  Type  I and  II 
errors  theoretical  formulas  were  derived  which  gave  these  error's  as  a function 
cf  standard  deviations  of  the  measured  attributes  for  individuals  and  for  the 
population  at  large.  Acceptability  was  measured  by  circulating  a question- 
naire designed  by  PAR  psychologists.  The  last  four  categories  were  evaluated 
by  engineering  investigations  of  verification  systems  based  on  the  respective 
attributes.  "Penetrability"  was  taken  to  mean  ease  of  access  by  a determined 
intruder  with  knowledge  of  the  detailed  operation  of  the  system. 

The  six  categories  were  weighted,  separability  and  acceptability  being 
most  important,  penetrability  being  the  least,  and  the  scores  were  combined  to 
attain  an  overall  ranking  for  each  attribute.  Some  judgment  was  required 
since  it  was  not  always  possible  to  assign  numerical  scores  to  the  attributes. 

Two  attributes  were  selected  for  detailed  investigation;  first,  flexion 
crease  lines  on  the  palm  and  fingers,  and  second,  electrocardiograms.  Crease 
lines  on  the  palms,  those  lines  used  by  chiromancers,  are  congenital  flexure 
lines  and  are  located  where  the  outer  layers  of  the  skin  are  more  firmly 
attached  to  the  subcutaneous  tissue.  In  choosing  crease  lines,  we  believed  we 

! 

would  have  an  attribute  as  rich  in  detail  as  a fingerprint,  as  permanent  as  a 
fingerprint,  but  present  on  a larger  scale.  This  latter  point  is  a fundamental 
one  for  automatic  recognition  systems.  It  makes  no  matter  how  good  an  attri- 
bute is;  the  end  result  will  depend  just  as  strongly  on  how  easily  the  attri- 
bute is  transduciblc.  The  electrocardiogram  (ECG)  was  selected  because. 


i 

! 

i 

L 
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although  not  unique  at  the  same  level  as  a finger  or  palmprint,  theoretical 
estimates  indicated  that  ECG's  could  meet  BISS  specifications.  It  was  further 
believed  that  the  ECG  could  be  used  to  produce  a low  cost  system.  This  is  in 
contrast  to  palm  or  fingerprints  which  require  optical  input  devices  with 
consequent  greater  cost. 

Palmprints  were  collected  from  72  people  by  placing  their  hands  on  a 
photocopying  machine.  The  copies  were  marked  at  a number  of  fiducial  points 
such  as  crease  lines  in  the  fingers  and  width  of  the  fingers  halfway  between 
each  crease  line.  Major  crease  lines  of  the  palm  were  extended  to  their 
intersection  with  the  silhouette  of  the  hand  to  gain  further  fiducial  points. 
These  fiducial  points  were  then  digitized  with  a graphics  tablet.  Interpoint 
distances  were  computed  to  form  thirty-four  measurements  on  each  palmprint. 
These  measurements  formed  a 34-dimensional  "feature  vector"  in  the  jargon  of 
pattern  recognition. 

The  next  step  was  to  find  those  subjects  whose  hands  looked  most  similar 
under  this  measurement.  With  one  feature  vector  per  subject,  we  had  72 
points  in  a 34-dimensional  space.  The  Euclidean  distance  between  all  pairs  of 
prints  was  computed,  and  a set  of  25  hands  comprising  "worst  case"  pairs  and 
triplets  was  identified  therefrom.  For  each  person  in  the  group  of  25,  a set 
of  10  handprints  was  collected,  the  subject  replacing  his  hand  on  the  machine 
for  each  copy.  Additionally,  two  more  prints  were  collected  for  all  72 
subjects. 


1-8 


This  data  was  placed  into  the  On-Line  Pattern  Analysis  and  Recognition 
System  developed  by  PAR  and  RADC  [1].  Using  the  measurement  reduction  routines 
in  OLPARS,  the  34  original  measurements  were  reduce  i to  nine  which  seemed  to 
carry  most  of  the  distinctiveness  between  individuals.  At  tiiis  point,  we  were 
prepared  to  evaluate  the  Type  I and  II  errors. 

Let  us  denote  the  subjects  by  the  symbols  A,  B,  C,  ...»  and  let  us 
suppose  that  A is  on  the  list  of  "worst  case"  hands.  Thus  thirteen  handprints 
are  available  for  A.  Using  ten  of  the  thirteen  prints,  we  designed  a weighted 
nearest-mean  vector  logic  [1]  with  a reject  boundary.  Ail  three  sets  of  72 
hands  are  tested  against  this  logic.  The  three  prints  of  A are  used  to  deter- 
mine a Type  I Error.  They  should  be  accepted  by  the  logic.  The  213  other 
palmprints  representing  intruders  should  be  rejected  by  the  logic  and  can  be 
used  to  determine  the  Type  II  Error.  This  procedure  is  then  repeated  for  the 
next  subject  on  the  "worst  case"  list  until  all  25  subjects  have  been  com- 
pleted. Then  the  Type  I and  II  Errors  are  computed  as  an  average  over  the 
errors  for  each  individual.  These  results  are  presented  in  Table  1-3. 

We  now  turn  to  a discussion  of  ECG  data.  It  is  envisioned  that  this 
access  control  device  will  consist  of  two  electrodes  to  which  the  person 
desiring  access  will  touch  his  hands.  We  therefore  collected  ECG's  with 
electrodes  attached  to  the  two  index  fingers  of  the  subjects.  No  ground 
electrode  was  used,  nor  was  any  electrode  paste.  The  subjects  were  told  to 
stand  normally.  Thus,  the  recorded  waveform  is  a highly  modified  ECG  and  to 
avoid  medical  connotations  we  have  called  it  a "C-trace."  ECG's  were  col- 
lected on  72  subjects  over  three  sessions.  The  waveforms  were  digitized  and 
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then  entered  into  t'  e I’AR  Waveform  Processing  System  [4]  for  smoothing  and 
automatic  segr.ienta;;ion  into  individual  beats.  A ten-dimensional  feature 
vector  was  extracted  from  the  waveforms.  The  data  was  again  manipulated  in 
LPARS  in  a fashion  very  similar  to  that  described  for  the  palmprints.  The 
results  are  shown  in  Table  1-3. 

The  results  of  Table  1-3  are  encouraging.  The  demonstration  of  feasi- 
lilitv  on  the  cardiogram  data  is  quite  interesting  in  that  the  signal  proces- 
sing ana  teature  e>. traction  was  almost  totally  automatic.  The  handprint  still 
requires  defining  an  appropriate  imaging  device  and  feature  extraction  algo- 
rithms, but  the  wealth  of  stable  features  on  the  palm  of  the  hand  indicate 
that  extremelv  small  error  rates  are  attainable.  We  recommend  continued 
developm.ent  of  both  attributes,  the  C-trace  for  use  in  low  security  areas,  at 
low  unit  cost,  and  the  handprint  for  higher  security  areas,  at  correspondingly 
higher  cost. 

1.2.  REPORT  ORGANIZATION 

Section  2 o'"  this  report  describes  the  first  task  of  the  effort,  the 
select 'on  of  two  physical  attributes  for  in-depth  study.  The  second  task, 
lata  collection  on  the  chosen  attributes,  is  given  in  Section  3.  The  final 
task,  the  analysis  of  the  data  and  estimation  of  Type  I and  II  error  rates, 
will  be  found  in  Section  4.  Section  5 provides  our  conclusions  and  recom- 
mendations . 
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SECTION  2 


ATTRIBUTE  SELECTION 


Task  I of  this  research  consisted  of  compiling  an  extensive  list  of 
physical  attributes  for  identity  purposes.  The  attributes  on  the  list  were 
then  reviewed  in  order  to  select  the  best  two  for  in-depth  data  collection  and 
analysis.  The  selection  would  complete  Task  I.  In  this  section  of  the 
report,  we  present  our  methodology  and  results  of  the  selection  task. 


2.1.  EVALUATION  PROCEDURE 


Even  from  the  earliest  PAR  staff  meetings  it  was  readily  apparent  that  a 
long  list  of  attributes  was  being  generated  for  evaluation.  It  was  felt  that 
the  evaluation  would  require  significant  library  research  and  contacting  of 
medical  expei'ts.  Consequently,  a team  of  over  ten  engineers  was  formed  to 
obtain  the  facts  necessary  to  perform  the  evaluation,  each  engineer  typically 
being  assigned  a few  attributes  for  investigation.  The  project  staff  was 
briefed  at  several  meetings  and  given  written  guidelines  for  evaluation.  The 
guidelines  are  reproduced  in  Appendix  A. 

The  guidelines  requested  that  the  evaluator  score  each  of  his  attributes 
on  the  basis  of  100  points  (perfect)  in  each  category.  He  was  not  necessarily 
apprised  of  the  weighting  of  the  categories  that  would  he  employed  in  obtain- 
ing a numerical  score  for  each  attribute.  The  principal  reason  for  not 
divulging  the  evaluation  formula  was  that  it  had  not  been  finalized,  but  a 
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secondary  motive  was  to  reduce  possible  evaluation  bias.  Note  from  Appendix  A 
that  engineers  were  asked  to  assume  an  advocacy  note  for  their  assigned 
attributes.  A "devil's  advocate"  or  negative  position  would  be  assumed  by  the 
evaluation  comittee.  Nevertheless,  frequently  the  same  people  were  involved 
in  both  defining  the  evaluation  formula  and  researching  the  attributes  so 
complete  independence  was  impossible. 

?.2.  EVALUATION  CRITERIA 

The  criteria  by  which  an  attribute  was  to  be  evaluated  are  listed  in 
Table  1-2.  We  now  discuss  each  criterion. 

2.2.1.  Separability 

The  separability  category  rated  an  attribute  in  regard  to  its  Type  I and 
II  error  performance.  A Type  I error  in  identity  verification  occurs  when  a 
person  A,  claiming  to  be  person  A,  is  rejected  by  the  identity  system.  A 
Type  II  error  occurs  when  a person  X,  claiming  to  be  A,  is  accepted  by  the 
system.  The  goal  of  the  study  was  to  obtain  a Type  I error  better  than  .01 
and  a Type  II  error  be ''ter  than  .02. 

Our  procedure  for  estimaing  separability  was  to  develop  formulas  for  Type 
I and  II  error  rates.  The  development  of  the  equations  is  relegated  to 
Appendix  B;  here  we  present  only  the  results.  Let  E^  and  E^^  be  the  Type  I 
and  II  error  rates  respectively.  A is  the  number  of  measurements  (the  dimen- 
sionality) made  on  the  personal  attribute.  Tor  example,  if  the  attribute  is 
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size,  we  might  imagine  measuring  height  and  weight,  in  which  case  A = 2.  The 
half  range  of  the  ith  measurement  over  the  entire  population  is  denoted  R^, 
while  the  standard  deviation  in  measuring  the  ith  feature  is  Then  and 

Ejj  can  both  be  expressed  in  terms  of  the  above  variables  and  a tolerance 
parameter  k,  which  measures  the  tolerance  on  a measurement  in  units  of  the 
standard  deviation. 


Ej  = 1 - erf(k/v^)^ 


(1) 


E 


II 


(2) 


Equations  (1)  and  (2)  clearly  shown  the  trade-off  which  exists  between  E^  and 
Ejj.  If  Ej  is  fixed  at  .01,  for  example,  by  suitable  choice  of  k,  then  E^^  is 
determined . 

Eor  many  attributes.  A,  r.,  and  could  be  estimated  from  physiological 
data.  The  engineers  reviewing  each  attribute  were  requested  to  fix  E^  at 
.01  and  use  the  resulting  E^^  as  the  separability  evaluation. 


2.2.2.  Acceptability 


Another  important  point  on  which  to  judge  an  attribute  is  its  accepta- 
bility to  the  user.  Measurements  which  produce  embarrasment , pain,  or 
apprehension  in  the  user  should  be  eliminated.  Our  procedure  for  evaluating 
this  important  criterion  was  to  employ  a staff  psychologist  to  design  and 
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evaluate  a survey  to  determine  acceptability.  The  survey  and  results  are 
contained  in  Appendix  C. 

2.2.3.  Feasibility 

The  technological  feasibility  is  an  important  criterion  for  two  reasons. 
First,  many  of  the  attributes  to  be  investigated  had  only  been  demonstrated  in 
laboratory  environments.  To  bring  the  technology  to  a point  where  it  could  be 
employed  for  access  control  might  take  many  years  of  development.  Second, 
feasibility  can  be  strongly  interlinked  with  separability  in  that  an  attribute 
which  might  exhibit  high  intrinsic  separability  might  be  less  attractive  if 
methods  of  transducing  the  attribute  are  found  to  degrade  its  uniqueness. 
Fingerprints  are  a good  example  of  this  problem.  Fingerprints  are  believed  to 
be  unique  to  an  individual.  Unfortunately,  the  scale  of  the  friction  ridges 
and  the  minutiae  which  produce  the  uniqueness  make  fingerprints  a very  diffi- 
cult attribute  to  utilize.  Thus,  the  feasibility  of  obtaining  a separability 
equal  to  the  known  uniqueness  of  fingerprints  is  essentially  zero.  One  must 
use  a lower  estimate  of  separability  to  achieve  a non-zero  feasibility. 

2.2.4.  Cost 


Three  categories  of  cost  were  considered;  development  cost,  purchase 
cost,  and  maintenance  cost. 
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2.2.5.  Speed 


TV 


The  time  required  for  personnel  to  gain  access  was  also  evaluated.  This 
proved  to  be  a useful  category  for  eliminating  some  of  the  more  exotic  attri- 
butes such  as  blood  composition. 

2.2.6.  Penetrability 

In  the  penetrability  category,  we  estimated  how  easily  a determined 
intruder  might  pass  the  system.  This  is  to  be  distinguished  from  Type  II 
error  which  refers  to  penetration  by  a casual  intruder.  The  casual  intruder 
is  assumed  to  be  drawn  at  random  from  the  general  population. 

There  are  two  aspects  to  penetrability.  The  determined  intruder  must 
first  "steal"  the  attribute  from  a legitimate  entrant  candidate  and  then 
duplicate  that  attribute  in  such  a manner  as  to  defeat  the  system.  External 
attributes  such  as  fingerprints  are  generally  easier  to  steal  than  internal 
attributes  like  electrocardiograms.  Electrocardiograms  might  be  simply 
duplicated,  however,  with  an  EM  tape  recorder.  Fingerprints  might  prove  more 
difficult,  depending  upon  the  method  used  for  transducing  the  print. 


2.3.  ATTRIBUTE  EVALUATION 


The  thirty-three  attributes  were  investigated  and  reports  on  most  are 
collected  in  Appendix  D.  Fron.  these  reports,  and  from  the  survey  on  accepta- 
bility described  in  Section  2.2.2.,  Table  2-1  was  produced.  Table  2-1  lists 
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^\CRITERIA 

ATTRIBUTES 

SEPARABILITY 

ACCEPTABILITY 

FEASIBILITY 

COST 

SPEED 

PENETRABILITY 

CONFIDENCE 

1. 

Palm  print 

85 

70 

80 

60 

60 

2. 

Finger  folds 

85 

70 

90 

60 

60 

3. 

Finger  lengths 

85 

100 

90 

80 

100 

4. 

Skin/hair  color 

40 

92 

90 

— 

100 

40 

— 

5. 

Vein  pattern 

85 

60 

80 

80 

60 

6. 

PPG  time  delays 

85 

80 

95 

80 

60 

7. 

Skin  resistance 

0 

75 

90 

— 

100 

60 

40 

8. 

Body  resistance 

— 

— 

40 

— 

100 

40 

40 

9. 

Tremours 

40 

85 

90 

90 

75 

80 

40 

10. 

Bone  pattern 

47 

70 

30 

100 

60 

11. 

IR  radiation 

— 

— 

— 

— 

— 

60 

40 

12. 

Eye  scan/dilation 

— 

— 

60 

— 

— 

80 

40 

13. 

Sonic. . .skull 

— 

47 

— 

— 

— 

— 

60 

14. 

Bite  pattern 

— 

— 

— 

— 

— 

— 

40 

15. 

Ear  structure 

68 

70 

80 

40 

80 

16. 

EEG 

— 

— 

— 

— 

80 

17. 

VEP 

55 

40 

95 

100 

60 

18. 

VEM 

— 

68 

— 

30 

— 

— 

40 

19. 

Saliva 

— 

— 

— 

— 

— 

— 

60 

20. 

Blood  comp. 

— 

10 

0 

— 

— 

— 

100 

21. 

Odor 

— 

— 

30 

— 

— 

— 

40 

22. 

Height/weight 

84 

100 

100 

100 

20 

100 

23. 

Gcii't  1 

— 

— 

30 

— 

— 

100 

60 

24. 

ECG 

75 

90 

90 

90 

80 

80 

25. 

BCG 

80 

70 

70 

90 

100 

40 

26. 

Verbal  Response 

— 

— 

— 

— 

— 

80 

80 

27. 

Personal  Hist. 

47 

75 

80 

80 

28. 

Typing  Style 

83 

100 

100 

100 

80 

80 

29. 

Lip  Grooves 

— 

47 

60 

— 

75 

40 

40 

30. 

Polygraph 

— 

— 

— 

— 

40 

— 

— 

31. 

Implanted  tags 

0 

— 

— 

— 

— 

— 

32. 

Body  vibrations 

30 

90 

100 

60 

33. 

Nail  grooves 

70 

60 

100 

40 

60 

WEIGHTS 

4 

3 

2 

2 

2 

1 

A. 

Mo  way  to  attach  electrodes 

Table  2-1  Personal  Attributes  Verification  Attribute  Evaluation 
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the  thirty-three  attributes  in  the  left-hand  column.  Along  the  top  of  Table 
2-1  are  the  criteria  on  which  the  attribute  was  evaluated.  The  row  of  numbers 


following  each  attribute  indicates  its  score  on  the  basis  of  100  in  each 
category.  Frequently,  the  evaluation  committee  used  its  judgement  to  temper 
some  of  the  ratings  given  by  the  researchers.  Some  entries  of  Table  2-1  are 
left  blank  where  it  was  obviously  impossible  to  arrive  at  a numerical  value. 
The  final  column  of  Table  2-1,  is  a number  assigned  by  the  evaluation  commit- 
tee, again  from  a minimum  of  0 to  a maximum  of  100,  to  indicate  a subjective 
evaluation  of  confidence  in  the  six  numbers  assigned  in  the  other  categories. 

2.4.  CHOICE  OF  TWO  BEST  ATTRIBUTES 

The  evaluation  committee  began  its  work  with  the  numerical  scores 
recorded  in  Table  2-1.  Because  many  scores  were  either  unavailable  or  not 
needed,  many  gaps  occur  in  the  table. 


The  formula  for  evaluation  of  the  attributes  was  basically  a weighted  sum 
of  all  the  categories.  The  exception  to  this  rule  was  that  we  required  a 
minimum  score  of  50%  in  all  categories.  The  weights  assigned  to  each  category 
are  shown  at  the  bottom  of  Table  2-1.  Separability  and  acceptability  were 
favored  by  the  weighting  formula.  Cost  and  feasibility  were  de-emphasized 
since  it  was  felt  that  technological  advances  might  alter  these  categories. 


In  discarding  attributes  which  failed  to  achieve  the  minimum  score  of  50% 
in  all  categories,  the  confidence  assignment  was  considered  to  be  a separate 
category.  This  was  felt  to  be  a mechanism  for  eliminating  attributes  which 
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irlght  superficially  appear  worthy  of  study,  but  for  which  detailed  or  reliable 
irfoi  dtion  was  lacking. 

Applying  the  above  strategy,  we  were  able  to  eliminate  from  further 
coi.sideration  skin/hair  color,  skin  resistivity,  body  resistivity,  finger 
• -emour  pattern,  bone  pattern  of  the  hand,  IR  radiation  pattern  of  the  hand, 
in  paths,  sonic  characteristics  of  the  skull,  bite  pattern,  ear  struc- 
troencephalograph , visually  evoked  potential,  visually  evoked 
:ield,  saliva,  blood  composition,  odor,  height/weight,  gait,  ballisto- 
ip.,  verbal  response,  personal  history,  lip  grooves,  polygraph, 

tags,  and  nail  grooves.  The  detailed  discussions  will  be  found  in 
. . However,  we  briefly  summarize  here  the  reasons  for  eliminating 
ttributes.  Skin  and  hair  color  were  felt  to  be  too  variable  to  achieve 
• actory  rating.  Skin  resistivity  was  a physiological  attribute  which 
le  to  measure,  but  apparently  quite  useless  for  identification  due  to 
ariability.  Body  resistivity,  as  measured  by  an  oscillating  magnetic 
was  an  inte’"osting  attribute  because  it  was  non-invasive  (assuming  low 
'wer  dissipated  in  the  body).  However,  the  problems  associated  with  metallic 
ejects  on  the  subject  seemed  difficult  to  handle.  The  suggestion  that  the 
■ etallic  objects  would  exhibit  a different  phase  in  the  complex  conductivity 
iu  r:,dde,  but  the  technological  risk  was  high  as  this  method  has  not  been 
Tested.  Bone  patterns  of  the  hand  were  to  be  measured  with  ultra-sound, 
ince  there  appeared  no  way  to  avoid  immersing  the  hand  in  water,  this 
ittiibute  was  rejected  as  being  unacceptable  to  the  user.  IR  radiation 
t iT-tern  of  the  body  or  hand  was  never  investigated  sufficiently  to  make  an 
iluation.  This  attribute  was  consequently  eliminated  on  low  confidence 


2-8 


rating.  Similar  remarks  apply  to  eye  scan  paths.  Sonic  characteristics  of 
the  skull  was  eliminated  due  to  a low  acceptability  score  since  it  was  felt 
that  adequate  signals  could  only  be  obtained  at  the  expense  of  some  user 
discomfort.  Bite  patterns  and  teeth  were  also  eliminated  on  the  basis  of  low 
acceptability,  however,  in  this  case,  the  reasons  were  more  psychological. 

Our  survey  on  user  acceptability  indicated  that  any  measuring  device  attached 
to  the  head  was  perceived  as  a higher  threat  than  similar  attachments  to  the 
extremities.  In  particular,  the  hand  is  a convenient  and  acceptable  place  to 
perform  a measurement.  Ear  structure  was  eliminated  due  to  low  penetrability 
score.  The  evaluation  committee  felt  it  would  be  a simple  matter  to  observe 
someone's  ear  structure  and  duplicate  it,  perhaps  with  a false  ear,  with  very 
low  probability  of  detection,  even  by  a human  observer.  Many  of  the  lineal 
features  which  would  be  measured  on  the  ear  are  morphologically  similar  to 
lineal  features  on  the  hands.  Since  the  hand  will  probably  be  brought  into 
contact  with  the  measuring  device,  tests  could  be  performed  to  determine 
whether  a false  hand  or  glove  was  being  used.  (One  might  test  for  the  pres- 
ence of  a PPG  signal,  for  example.  See  Section  D.u.)  Conversely,  since  the 
imaging  of  the  ear  would  be  done  remotely,  no  such  test  could  be  performed. 
Also,  the  hand  is  much  more  easily  brought  to  the  sensing  device  than  the  ear. 
In  short,  the  hand  has  the  advantages  of  the  ear,  richness  of  detail  and 
uniqueness,  but  lacks  many  of  the  disadvantages.  Electroencephalography  was 
eliminated  in  favor  of  the  closely  related,  active  technique  of  visually 
evoked  potentials  (VEP).  VEP  was  itself  eliminated  due  to  low  feasibility 
score.  Mo  method  of  easily  attaching  electrodes  was  discovered.  Although,  in 
light  of  the  excellent  results  we  eventually  obtained  on  electrocardiograms 
with  dry  electrodes,  VEP  is  perhaps  worth  new  consideration.  Visually  evoked 


-9 


r.agnetic  fields  would  te  too  costly  to  pursue.  A good  deal  of  low  temperature 
•■quipment  would  need  to  be  assembled.  Saliva  was  ruled  out  for  low  technologi- 
cal feasibility  and  low  confidence.  Its  uniqueness  and  the  capability  to 
inalyze  saliva  in  an  entry  access  environment  was  not  convincingly  demonstrated 
‘v  the  research.  Blood  composition  tests  were  not  acceptable  to  the  users,  in 
: act  scoring  lowest.  Odor  detection  at  the  required  concentrations  appears  to 
yet  be  beyond  present  technology.  Height/weight  measurements  were  eliminated 
due  to  low  penetrability  score.  However,  a combination  of  these  measurements 
with  other  simple  physical  attributes  still  appears  a viable  technique, 
jlthough  outside  the  scope  of  the  present  investigation.  Gait  was  eliminated 
when  no  automatic  measurement  technique  was  apparent.  The  ballistocardiogram 
was  eliminated  in  preference  to  the  more  easily  investigated  electrocardio- 
gram. Verbal  response  and  personal  history  were  rejected  as  being  outside  the 
scope  of  the  investigation.  They  further  demand  certain  basic  literacy  levels 
which  make  them  not  ideally  suited  for  all  applications.  Lip  grooves  were 
■“liminated  for  low  acceptability.  The  polygraph  would  take  too  much  time  and 
was  therefore  rejected.  Implanted  tags  were  judged  unacceptable.  Body 
vibrations  are  being  pursued  by  others  and  results  are  not  yet  available, 
i'inally,  nail  grooves  scored  poorly  in  the  penetrability  category.  As  in  the 
case  of  ear  structure,  the  evaluation  committee  felt  that  the  system  could  be 
•.asily  defeated  with  a false  nail  overlay  and  that  no  simple  tests  to  detect 
the  fake  nail  were  available.  Thus,  most  attributes  were  eliminated  through 
this  preliminary  screening. 

The  remaining  attributes  are  collected  in  Table  2-2.  The  evaluation 
committee  also  listed  a group  of  attributes  of  secondary  rank.  We  cannot 
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Table  2-2  Personal  Attributes  kemaining  in  Survey  after  Pre- 
liminary Screening 


Palm  prints 

Finger  folds 

► Can  study  as  one  attribute 

Finger  geometry 

Vein  patterns  on  back  of  hand 

Electrocard iograph 

Table  2-3  Personal  Attributes  Eliminated  from  Study  But  of 
High  Rank 


Visually  Evoked  Potential 
Personal  History  (Question/Answer) 
Ballistocardiogram 


Table  2-4  Personal  Attributes  Eliminated  from  Study  But  of 
Potential  Use  in  Combination 


ringer  lengths  (Identimat  Corp.) 
Typing  style 
Height/woight 
PPn  Time  Delays 


overemphasize  that  opinions  came  strongly  into  play  in  the  final  attribute 
screening.  Those  attributes  eliminated  are  not  being  rejected  as  unusable  in 
the  future.  Indeed,  technological  breakthroughs  are  apt  to  make  almost  any 
one  of  the  physical  attributes  studied  a viable  technique  for  automatic  iden- 
tification. Table  2-3  lists  those  attributes  which  came  closest  to  meeting 
the  criteria  and  will  perhaps  be  useful  in  the  future.  Table  2-4  summarizes 
attributes  which  were  eliminated  on  the  basis  of  low  separability  scores,  but 
which  appear  to  have  the  advantage  of  being  measurable  at  low  cost.  They 
would  thus  be  useful  in  combination  with  themselves  and  other  simple  attri- 
butes. 

It  was  felt  by  the  evaluation  committee  that  the  first  three  attributes 
of  Table  2-2  could  be  combined  in  one  pilot  study.  How  this  was  accomplished 
is  discussed  in  the  following  section.  Vein  patterns  on  the  back  of  the  hand 
were  felt  to  be  of  high  interest,  but  in  regard  to  feature  extraction,  very 
similar  to  palm  lines.  Electrocardiographs  had  the  nice  property  of  employing 
a transducer  technology  distinctly  different  from  that  of  the  palm  prints  and 
vein  patterns.  This  was  felt  to  be  valuable  for  lowering  the  technological 
risk  of  Phases  II  and  III  of  this  investigation.  Consequently,  the  two  attri- 
butes selected  were  handprints  (actually,  a combination  of  palm  prints,  finger 
folds,  and  finger  geometry)  and  electrocardiograms  (actually,  a highly  modified 
lead  system).  With  these  choices.  Phase  I was  complete.  Data  collection  and 
analysis  on  the  two  chosen  attributes  remained. 
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2.5. 


DISCUSSION  OF  TWO  SELECTED  ATTRIBUTES 


The  major  reason  for  selecting  the  handprint  as  an  attribute  to  be 
studied  further  was  our  judgement  that  it  is  sufficiently  rich  in  detail  to 
meet  even  the  most  stringent  error  specifications.  This  richness  is  illus- 
trated by  the  fact  that  all  three  attributes  of  Table  2-2  can  be  measured  at 
the  same  time,  yet  they  are  all  independent  and  can  contribute  therefore  to  an 
excellent  separability.  The  three  attributes  of  palm  prints,  finger  folds, 
and  finger  geometry  can  be  measured  simultaneously  from  a single  image.  If 
the  hand  is  illuminated  obliquely  from  the  front  (palm)  side  against  a dark 
background,  then  the  silhouette  will  permit  extensive  measurements  of  finger 
geometries.  The  silhouette  of  the  hand  produces  crisp  outlines  from  which  the 
endlessly  variable  shapes  of  the  finger,  blunt,  conical,  tapering,  crooked, 
may  be  extracted.  The  creases  of  the  finger  folds  and  palm  fold  lines  will  be 
enhanced  by  the  oblique  illumination.  We  believe  that  the  friction  ridges  of 
the  palm,  although  as  unique  as  those  of  the  finger  tips,  are  too  small  to 
permit  good  measurements.*  The  flex  lines  of  the  fingers  will  permit  measure- 
ment of  finger  segment  lengths  and  provide  fiducial  points  at  which  to  measure 
finger  widths.  The  flex  lines  of  the  palm  are  not  only  of  a size  to  pennit 
resolution  by  straightforward  devices,  but  are  rich  in  detail.  In  the  subse- 
quent sections  we  shall  refer  to  the  attribute  as  "handprint,"  and  this  term 
will  mean  (1)  finger  and  hand  geometry  measurable  from  the  silhouette  plus  (2) 
finger  flex  lines  plus  (3)  palm  flex  and  crease  lines. 

* The  same  objection  applies  to  fingerprints,  although  Calspan  Corp.  is 

pursuing  an  identification  system  based  on  the  fingerprint.  Any  results 
of  their  investigation  will  be  more  useful  for  assessing  the  performance 
of  the  technique  than  hypothetical  speculation. 
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The  major  reason  for  selecting  the  ECG  as  a physical  attribute  is  that  it 
appears  to  have  adequate  separability  and  also  appears  to  be  capable  of  rapid 
technological  development.  This  latter  point  follows  from  the  fact  that 
electrocardiography  is  an  ancient  medical  technique  when  measured  on  a time 
scale  consistent  with  the  rapid  advances  in  medical  science  the  last  two 
decaiies  have  produced.  Furthermore,  extensive  work  has  already  been  done  on 
automatic  processing  of  ECG's  for  computer  diagnosis  and  storage.  We  will 
thus  be  building  on  established  fact.  Finally,  there  appears  to  be  no  tech- 
nology gap  in  any  area  of  ECG's  for  access  control,  no  new  amplifiers,  scanners, 
jigs,  rigs,  or  high  speed  processors.  If  the  ECG  can  be  shown  to  work  satis- 
factorily, then  all  of  the  above  argue  that  development,  installation,  and 
maintenance  costs  can  be  agreeably  low  compared  to  other  access  control 
devices. 

As  we  have  already  mentioned  in  Section  1.1.  and  will  describe  in  more 
detail  later,  the  method  of  ECG  measurement  we  shall  employ  consists  of  two 
dry  electrodes  attached  to  the  index  fingers.  This  is  not  a medical  lead 
system  and  to  avoid  any  medical  connotation  to  the  measurement  we  have  named 
it  C-trace  ('C  for  "cardiogram"). 

An  interesting  aspect  of  the  C-trace  is  that  it  is  a much  more  private 
attribute  than  voice,  fingerprints,  finger  lengths,  or  handprints,  which  are 
all  externally  visible.  The  C-trace  is  similar  to  signature  verification 
(which  actually  measures  pressure  history  of  the  signature)  and  body  vibration 
transfer  function  which  are  internal  and  remain  hidden.  These  latter  attributes 
would  appear  much  less  susceptible  to  hostile  penetration  due  to  their  covertness 


A disadvantage  of  the  C-trace  is  that  the  time  to  record  the  necessary 
heartbeats,  perhaps  eight,  will  always  be  five  seconds  or  so,  placing  an  upper 
limit  on  throughput.  Additionally,  although  our  survey  determined  the  C-trace 


to  be  acceptable  to  users,  it  did  not  score  as  highly  in  this  category  as 
handprints . 

In  the  next  two  sections  we  describe  in  detail  the  data  collection  and 
processing  which  produced  the  error  results  quoted  in  Table  1-3. 
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SECTION  3 


DATA  COLLECTION  (PHASE  II) 


This  section  sets  forth  the  methods  by  which  the  handprint  and  cardiogram 
data  were  collected.  The  hardware  configurations  are  described  and  samples  of 
the  data  are  presented.  The  amount  and  structure  of  the  data  obtained  for 
further  processing  is  also  given. 


3.1.  HANDPRINTS 


To  demonstrate  the  feasibility  of  using  handprints  for  verification 
purposes,  a large  amount  of  data  is  required.  Thus,  any  means  of  handprint 
collection  must  be  convenient  as  well  as  accurate.  Not  only  does  a large 
photocopying  machine  meet  these  specifications,  but  it  also  provides  a perma- 
nent record  of  all  data. 

Distortion  introduced  by  the  copier  was  of  some  interest.  To  determine 
the  distortion  errors  produced  by  a copier,  the  following  simple  experiment 
was  conducted. 

Step  1:  Draw  straight  lines  at  various  locations  on  white  paper. 

Step  2:  Measure  the  lengths  of  these  lines  with  a magnification 

comparator. 
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Step  3:  Make  a copy  of  the  paper.  The  location  of  the  original 

was  carefully  settled. 

Step  4:  Measure  the  lengths  of  the  lines  on  the  copy  with  the 

comparator. 

Step  5:  Calculate  for  each  line  the  ratio  of  the  original  length 

to  that  of  the  copied  one. 

Figure  3-1  shows  the  original  seven  groups  of  lines.  Each  group  consists 
of  three  vertical  and  three  horizontal  lines  marked  as  shown.  The  lengths  of 
these  lines  and  the  copies  were  measured  with  a Gurley  Rapid  Comparator  Model 
7055,  and  copies  on  two  machines  were  generated;  an  IBM  Copier  II  and  a Xerox 
4500.  A summary  of  results  is  given  in  Table  3-1:  full  results  for  each  line 
appear  in  Tables  3-2  and  3-3.  From  this  experiment  it  was  concluded  that  the 
IBM  Copier  II  is  superior  to  the  Xerox  4500  in  both  magnitude  and  uniformity 
of  the  magnification  factor.  Further  experiments  were  performed  with  the 
results  that  the  magnification  is  location  dependent  but  time  invariant. 

In  order  to  obtain  the  best  possible  hand  image  from  the  copier,  images 
from  a variety  of  hand  orientations  and  several  degrees  of  applied  pressure  by 
the  hand  on  the  copy  surface  were  examined.  As  a result,  all  applicants  were 
instructed  in  the  same  way:  place  the  right  hand  comfortably  but  firmly  on 
the  copy  surface,  fingers  spread.  Cover  it  with  a cloth,  then  position  the 
left  hand  on  the  cloth  over  the  right  hand.  The  resulting  image  has  suffi- 
cient detail  to  define  and  mark  the  features.  A typical  copy  is  shown  in 
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r igure  3 


Mean  Magnification 

1.0016 

1.0104 

Horizontal 

Magnification 

1.0023 

1.0085 

Vertical 

Magnification 

1.0009 

1.0123 

Table  3-1  Magnification  factors  for  Two  Photocopying  Machines. 


Line  Id 

Original 

IBM  Copiei’  II  1 

Xerox  4500 

AV  1 

44.9 

44.8 

45.4 

2 

44.1 

44.2 

44.9 

3 

42.9 

42.9 

43.3 

AH  1 

44.2 

44.3 

44.6 

2 

43.4 

43.4 

43.5 

3 

43.0 

42.9 

43.5 

BV  1 

44.0 

44.1 

44.5 

2 

42.2 

42.3 

42.7 

3 

42.2 

42.4 

42.7 

BH  L 

42.4 

42.6 

42.8 

2 

43.2 

43.4 

43.5 

3 

42.8 

42.9 

43.0 

CV  1 

46.4 

46.4 

46.9 

2 

47.1 

47.3 

47.8 

3 

47.9 

48.1 

48.6 

CH  1 

39.3 

39.1 

39.4 

o 

37.4 

37.0 

37.7 

3 

37.6 

37.3 

38.1 

DV  1 

34.9 

35.1 

35.3 

2 

35.1 

35.3 

35.5 

3 

36.6 

36.8 

37.1 

DH  1 

42.2 

42.4 

42.6 

2 

42.5 

42.6 

42.8 

3 

38.0 

38.3 

38.4 

EV  1 

39.7 

39.7 

40.2 

2 

38.5 

38.4 

39.1 

3 

38.5 

38.5 

39.0 

EH  1 

45.5 

45.8 

46.0 

2 

44.7 

45.0 

45.3 

3 

43.4 

43.6 

43.8 

rv  1 

40.0 

40.1 

40.4 

2 

40.2 

40.4 

40.6 

3 

39.8 

40.  0 

40.4 

EH  1 

46.2 

46.5 

46.6 

2 

46.9 

47.2 

47. H 

3 

47.5 

47.8 

47.9 

GV  1 

43.7 

43.8 

44.2 

2 

44.7 

44.9 

45.2 

3 

44.7 

44.7 

45.1 

GH  1 

42.4 

42.] 

42.8 

O 

42.8 

42.4 

43.0 

3 

43.4 

43.  L 

43.8 

t ! 

i i 

1 Table  3-2  Line  Lengths  in  Machine  Distortion  Study  (nim) 
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Figure  3-2.  Unfortunately,  the  quality  of  reproduction  in  technical  reports 
degrides  the  quality  of  the  original  photocopy  image  considerably. 

Handprints  by  their  nature  are  quite  stable  in  time  (see  Section  D.l). 
TFius,  no  individual  variation  was  expected  during  the  time  frames  involved  in 
the  handprint  data  collection.  The  handprint  images  were  obtained  at  any  time 
convenient  to  both  the  researcher  and  the  subject. 

he  handprint  data  is  arranged  in  two  formats.  All  72  subjects  had  hand- 
prints collected  on  three  days.  Then  25  were  chosen  for  detailed  study.  For 
-hese  25  people,  10  additional  handprints  were  collected.  The  25  people  were 
selected  as  follows: 

First,  one  handprint  from  each  of  72  people  forms  a reference  set.  There 
are  three  such  sets,  each  collected  on  a different  day.  Measurements  were 
extracted  from  the  first  reference  set,  a process  described  in  detail  below. 
Additional  processing  was  used  to  measure  the  similarity  (Euclidean  distance 
[2])  between  each  pair  of  hands  (individuals).  The  sets  of  vectors  that  were 
closest  together  thus  corresponded  to  those  hands  that  were  most  similar.  The 
25  worst  cases,  the  hands  most  likely  confused,  form  the  second  data  file. 

An  additional  ten  different  images  of  each  of  these  hands  were  collected 
at  one  time.  By  choosing  the  worst  cases,  those  hands  most  similar,  the  error 
estimates  obtained  from  the  classification  logic  could  be  considered  to  be  the 
•worst  possible  performance  of  the  logic.  Choosing  hands  less  similar  should 
decrease  the  error  rates. 


3-7 


In  any  dedicated  system,  the  handprint  collection  and  feature  extraction 
must  be  accomplished  automatically.  To  date  we  have  investigated  the  achiev- 
able resolution  of  the  parts  of  the  hand  by  using  a television  camera  and  have 
concluded  that  a satisfactory  image  can  be  obtained  (Appendix  H).  The  algo- 
rithms by  which  the  features  are  found  and  measured  from  the  image  have  not 
been  developed. 


3.2.  CARDIOGRAMS 


Because  any  dedicated  verification  system  must  be  acceptable  to  its 
users,  all  cardiogram  data  was  collected  in  a simple  manner.  Two  electrodes 
were  attached  to  the  index  fingers  without  a ground  lead  or  electrode  paste. 
Figure  3-3  depicts  a data  collection  session.  A stripchart  recording  of 
typical  signals  measured  by  a Hewlett-Packard  1500B  Electrocardiograph  is 
shown  in  Figure  3-4.  The  horizontal  scale  is  .4  sec/cm;  the  vertical  scale,  1 
mV / cm . 

During  the  data  collection  phase,  each  person  at  each  of  three  sessions 
had  recorded  a 30-40  second  tracing.  To  manage  such  a large  amount  of  data, 
all  tracings  were  recorded  on  an  FM  analog  tape  recorder  and  later  digitized 
at  a convenient  time.  Each  person  was  told  to  stand  erect  but  comfortably  and 
was  requested  not  to  move  or  speak  since  the  technique  is  sensitive  to  any 
other  muscular  activity. 

The  configuration  in  Figure  3-5  was  used  to  record  the  data.  The  re- 
corder electronics  were  calibrated  to  a 100  Hz  20V  p-p  sine  wave  before  each 
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Figure  3-5  Electronic  block  diagram  for  recording  and  digitizing 
ECG  data. 


recording  session.  The  filter  was  low  pass  with  a 3 kHz  cutoff  frequency  and 
had  a gain  of  20  dB.  The  data  and  the  time  code  were  recorded  simultaneously 
on  non-ad jacent  channels  of  the  recorder. 

The  Hewlett-Packard  1500B  has  a high-gain  differential  input.  The  car- 
diogram signal  rides  on  a large  and  time-varying  DC  offset  which  must  be 
balanced  out  manually  to  bring  the  output  voltage  of  the  1500B  differential 
amplifier  into  a range  where  it  can  be  recorded  on  analog  tape.  This  balanc- 
ing was  accomplished  manually  at  the  time  of  data  collection  by  visually 
monitoring  the  stripchart  needle  on  the  1500B  and  adjusting  the  DC  bias 
control  on  the  unit. 

Playback  of  the  data  was  accomplished  with  the  configuration  depicted  in 
Figure  3-5.  The  amplifier  was  used  in  the  variable  gain  mode,  and  was  set  at 
the  beginning  of  each  digitizing  session  so  that  a calibration  signal  out  of 
the  electrocardiograph  resulted  in  a digital  signal  of  the  same  amplitude. 

The  A/D  converter  has  15  bit  capacity,  and  we  used  this  full  range  to  accom- 
modate the  full  input  signal  of  2 mv  peak-to-peak.  The  power  signal-to-noise 
ratio  due  to  the  sampling  procedure  is 

SNR  = 3.2  X 10*^  P 

where  P is  the  mean  square  value  of  the  input  cardiogram  signal  expressed  in 

2 2 
(millivolts)  [3].  For  a typical  value  of  P = (.1  mv)  , 

SNR  = 75  dB. 
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This  SNR  is  greater  than  the  signal  quality,  so  no  appreciable  noise  is  added 
by  the  digitization  process.  In  addition,  the  medical  literature  suggests 
that  the  bandwidth  of  ECG's  is  fairly  low,  less  than  100  Hz.  (Appendix  B). 

The  sampling  rate  used  was  1 kHz,  quite  sufficient  to  obtain  all  relevant 
frequency  information.  Figure  3-6  shows  a typical  data  sample  immediately 
after  digitization,  and  Figure  3-7  shows  the  power  spectrum  of  this  data.  The 
SNR  is  approximately  45  dB,  and  the  signal  energy  appears  at  below  200  Hz. 
Noise  at  the  line  frequency  and  its  two  harmonics  are  prominent.  The  1 kHz 
sampling  rate  thus  represents  an  oversampling  by  more  than  a factor  of  two 
over  the  Nyquist  [3]  rate. 

Table  3-4  summarizes  the  cardiogram  data  obtained  at  the  three  sessions. 
It  should  be  noted  that  tracings  from  some  people  were  recorded  at  different 
gain  settings  on  the  electrocardiograph  itself  to  provide  for  full  use  of  the 
allowable  signal  range.  In  addition,  the  totals  given  represent  the  number  of 
people  from  which  the  indicated  number  of  tracings  were  received,  regardless 
of  when  those  tracings  were  recorded.  Time  constraints  did  not  permit  all 
subjects  to  participate  in  the  collection  at  all  three  sessions.  Thirty  of 
the  forty-seven  people  for  which  there  are  three  tracings  account  for  the  data 
subsequently  used  for  the  logic  evaluation. 
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Typirr^l  '^ardiorrani  Trarr^. 


Session 

Date 

Number  of 
Different  People 

Number  of 
Tracings 

13  Jan  77 

57 

65 

2 

19  Jan  77 

44 

49 

3 

8 Feb  77 

49 

85 

Totals 

Number  of 

Number  of 

Tracings 

People 

3 

47 

2 

10 

1 

10 

Table  3-4 


Cardiogram  Data  Collection. 


SECTION  4 


DATA  ANALYSIS  (PHASE  III) 


This  section  describes  how  the  data  collected  during  Phase  II,  both 
handprints  and  ECG's,  was  analyzed.  Results  in  Type  I and  Type  II  errors  are 
given. 

4.1.  HANDPRINTS 

In  this  section,  we  present  the  error  estimates  obtained  for  the  hand- 
prints and  the  processing  used  to  obtain  them.  The  error  estimates  are 
encouraging  and  confirm  that  enough  information  does  exist  in  a handprint  to 
perform  verification  in  a dedicated  system.  Since  the  handprint  features  were 
extracted  manually,  very  little  processing  of  the  features  was  necessary. 
Before  the  error  results  are  presented  and  explained,  the  features  themselves 
are  discussed. 

4.1.1.  Feature  Definition  and  Extraction 


The  most  striking  characteristics  of  a hand  are  the  sizes  of  its  various 
■ art: . Figure  D-1  shows  the  major  bones  of  the  hand.  Though  we  cannot 
easily  measure  their  dimensions,  they  do  suggest  their  sizes  by  the  position 
thf  creases  on  the  h.and  itself.  The  creases  appear  where  the  bones  allow 
the  fingers  and  hand  to  bend,  and  should  therefore  provide  ample  information 
about  the  sizes  of  the  parts  of  a hand  to  distinguish  one  hand  from  another. 


Figure  D-2  shows  the  main  creases  in  the  hand.  From  Figures  3-2  we  observe 
that  one  of  the  most  outstanding  features  on  the  hand  image  is  the  creases. 

One  strategy  for  defining  a first  set  of  features  is  to  use  as  many  of 
them  as  are  thought  to  contain  information  relevant  for  verification.  After- 
wards, those  features  not  contributing  much  information  can  be  discarded,  and 
a more  manageable  feature  set  can  be  determined.  This  is  indeed  the  strategy 
chosen  for  the  handprints,  since  the  cost  in  time  and  complexity  for  extract- 
ing additional  features  is  diminishingly  small.  Consequently  thirty-four 
features  were  defined  as  shown  in  Figure  4-1.  Subsequent  feature  analysis  in 
OLPARS  [1]  resulted  in  the  choice  of  nine  features  for  the  reduced  feature 
set.  These  nine  were  deemed  the  most  distinguishing  measurements  of  the 
original  34  relative  to  our  72  person  data  base  and  are  shown  in  Figure  4-2. 

After  a hand  is  copied,  the  eighteen  endpoints  defining  this  reduced 
feature  set  are  manually  marked  on  the  copy,  then  entered  into  the  computer 
with  a Tektronix  4953  Data  Tablet.  This  digitization  results  in  the  features 
shown  graphically  on  the  computer  display  as  in  Figure  4-3.  Once  these  points 
are  entered  into  the  computer,  the  features  are  computed  and  submitted  to 
logic  design  and  evaluation. 

4.1.2.  Logic  Design  and  Evaluation 

The  method  used  to  analyze  the  feature  vectors  develops  from  the  typical 
scenario  describing  the  use  of  this  data  in  a dedicated  system.  An  applicant 
requesting  access  to  a classified  area  inputs  a password  to  the  system.  This 


password  indicates  to  the  system  under  which  identity  he  is  attempting  to  gain 
.iccess.  The  system  now  digitizes  an  image  of  the  applicant's  hand,  by  a 
television  camera,  for  example,  and  automatically  extracts  the  features.  This 
feature  vector  is  then  compared  to  the  mean  vector  of  the  identity  class 
previously  determined  by  the  applicant's  password,  and  an  accept  or  reject 
decision  is  made. 

Note  that  this  problem  is  a one-class  design  problem,  and  the  applicant 
either  is  determined  to  belong  to  the  class  under  which  he  identified  himself 
or  he  is  rejected.  No  effort  is  made  to  classify  the  applicant  further. 
Nearest  Mean  Vector  (NMV)  logic  is  used  for  both  Type  I and  II  Error  evalua- 
tions. Generalized  NMV  logic  is  a k-class  classification  technique;  it 
classifies  an  unknown  vector  according  to  a metric  computed  from  the  unknown 
vector  to  the  mean  vectors  of  the  k classes.  The  decision  is  in  favor  of  the 
class  which  produces  the  minimum  value  of  the  metric.  In  the  case  here,  k=l 
and  the  value  of  the  metric  must  be  less  than  some  threshold  for  the  unknown 
vector  to  belong  to  the  class;  otherwise,  the  vector  is  rejected.  The  metric 
chosen  is  the  weighted  Euclidean  distance;  hence  we  require  the  variances  of 
the  design  vectors  along  each  coordinate. 

The  handprint  data  is  arranged  in  two  files,  is  shown  schematically  in 
Figure  4-..  First,  one  handprint  from  each  of  72  people  forms  a reference 
set.  There  are  three  such  sets,  each  set  having  been  collected  on  a different 
day.  After  processing  the  first  reference  set  to  obtain  the  feature  vectors, 
an  additional  processing  step  is  used  to  determine  those  feature  vectors,  and 
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72  Subjects 
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Design  j 
Data 
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y 

25  Subjects 


3 Handprints  from 
3 different  days 


. 25  most  similar 
hands 


. nine  or  ten  prints 
from  same  day 
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Pictorial  representation  cf  the 
data  collected,  design  data  and 
Each  line  indicates  a handprint 


two  types  of 
test  data. 


here,  -'lose  hands,  that  are  most  similar.  These  worst  cases,  the  hands  most 
liKe^-.  onfused,  form  the  basis  of  the  second  data  file. 

'’ri  additional  ten  different  images  of  each  of  these  hands  were  collected, 
marks' , and  entered  into  the  computer.  There  are  twenty-five  such  groups 
presently  available.  By  choosing  the  worst  cases,  those  hands  most  similar, 
the  error  estimates  obtained  from  the  classification  logic  can  be  considered 
to  be  the  worst  possible  performance  of  the  logic.  Choosing  hands  more  dis- 
similar should  decrease  the  error  rates. 


In  the  overall  error  analysis,  the  groups  of  ten  vectors  serve  as  the 
design  sets.  Thus  the  class  means  and  variances  are  estimated  from  these 
sets,  and  the  classification  logic  is  designed  on  each  class  separately.  For 
the  error  estimates  presented  in  Figure  4-4,  each  design  logic  was  evaluated 
using  all  other  design  sets  and  the  three  reference  sets,  with  the  results  for 
each  class  averaged  together.  For  example,  using  the  notation  of  Figure  4-4, 
weighted  NMV  logic  is  designed  on  the  ten  design  vectors  of  subject  B.  A 
reject  boundary  is  employed.  The  three  test  data  vectors  of  B are  then  sub- 
mitted to  the  logic.  Any  rejection  is,  of  course,  a Type  I Error.  Similarily 
for  E,  F,  H,  etc.  The  Type  I Errors  for  all  25  of  these  design  hands  are 
averaged  to  obtain  an  overall  Type  I Error  estimate.  Thus,  if  B and  F each 
have  one  of  their  respective  three  test  handprints  rejected  by  the  logic,  the 
average  Type  I error  would  be  2 errors  out  of  75  attempts  (3  test  hands  x 25 
subjects  = 75  attempts).  To  arrive  at  a Type  II  Error  estimate  for  subject 
B's  entry  code,  subject  A,  C,  D,  E,  F,  ...  test  data  and  subjects  E,  F,  H,  ... 
design  data  are  submitted  to  the  logic.  The  number  of  vectors  accepted 
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divided  by  the  number  of  attempts  ( 24  x 10  = 71  x 3 ) is  the  Type  II  Error  for 
B's  access  code.  After  proceeding  in  a similar  fashion  for  E,  F,  and  H,  the 
average  Type  II  Error  may  be  computed.  In  Figure  4-5,  we  present  the  Type  I 
and  II  errors  which  resulted  from  a simple  strategy  of  using  the  same  rejec- 
tion threshold  for  all  25  subjects  in  the  design  group.  The  results  are  shown 
in  tabular  form  at  the  bottom.  One  subject's  test  data  was  poorly  reproduced 
on  the  copier.  It  was  therefore  eliminated  leaving  only  72  Type  I attempts. 
Also,  for  20  subjects,  only  9 copies  were  made  of  design  data,  for  the  5 
remaining  subjects,  10  copies  were  made.  Thus,  the  resulting  Type  II  attempts 
amounted  to  10773,  as  given  in  Table  4-1,  The  graph  at  the  top  of  Figure  4-5 
provides  a plot  of  the  tabular  results. 

The  results  presented  in  Figure  4-5  for  the  Type  I Error  rate  were 
unsatisfactory.  In  investigating  these  results,  it  was  discovered  that  some 
of  the  25  design  sets  clustered  significantly  better  than  others  did.  With  at 
most  ten  nine-dimensional  vectors  in  each  design  class,  the  estimates  of  the 
mean  vector  and  covariance  matrix  are  at  best  rudimentary;  a deviation  in  any 
vector  component  will  change  these  estimates  by  a non-negligible  amount. 

Using  the  same  threshold  for  each  class,  then,  does  not  achieve  the  best 
possible  performance.  Consequently,  a new  strategy  was  employed  - a variable 
threshold  with  class.  Choosing  the  threshold  from  the  range  (4,  10)  that 
minimizes  the  number  of  Type  I Errors  for  each  class  yields  the  statistics 
shown  in  Table  4-2.  The  average  Type  I Error  is  1 out  of  72  attempts  for 
1.‘*  the  dve.  xge  Ty;.e  II  Error  is  177  out  of  10773  attempts  for  1.64%. 


THRESHOLD 

TYPE  I 
Out  of  72 

ERRORS 

Attempts 

TYPE 

Out  of 

II  ERRORS 
10773  Attemp' 

4.0 

44 

61% 

16 

. 15% 

5.0 

26 

36% 

43 

.40% 

6.0 

20 

28% 

103 

.96% 

7.0 

13 

18% 

184 

1.7% 

8.0 

3 

4.2% 

368 

3.4% 

9.0 

3 

4.2% 

627 

5.8% 

10.0 

1 

1.4% 

927 

8.6% 

Tablf  4-1  Error  Rates  For  Uniform  Threshold 
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CLASS 

THRESHOLD 

TYPE  I ERRORS 

TYPE  II  ERRORS 

1 

4. 

0 

0 

2 

5. 

0 

0 

3 

5. 

0 

0 

4 

5. 

0 

0 

5 

5. 

0 

0 

6 

6. 

0 

0 

7 

5. 

0 

2 

8 

7. 

0 

0 

9 

7. 

0 

0 

10 

8. 

0 

12 

11 

10. 

0 

3 

12 

10. 

0 

26 

13 

8. 

0 

0 

14 

8. 

0 

6 

15 

4. 

1 

0 

16 

8. 

0 

29 

17 

8. 

0 

3 

18 

6. 

0 

46 

19 

5. 

0 

2 

20 

8. 

0 

33 

21 

7. 

0 

1 

21 

5. 

0 

12 

23 

5. 

0 

0 

2-* 

8. 

0 

1 

25 

4 . 

0 

1 

Table  4-2  Variable  Threshold  Statistics 
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Even  the  best  performance  of  certain  classes  as  shovm  in  Table  4-2  is 
below  average;  notably  classes  10,  12,  16,  18,  20  and  22  for  their  Type  II 
Errors,  and  class  15  for  its  Type  I Error.  In  an  attempt  to  explain  such 
behavior,  consider  Table  4-3.  Listed  in  Table  4-3a  are  the  average  variances 
over  all  25  classes  for  each  measurement,  and  a ranking  of  these  variances 
from  highest  to  lowest.  Table  4-3b  lists  all  classes  that  have  a variance  of 
any  measurement  greater  than  the  arbitrary  value  of  200.  Notice  that  in 
almost  all  cases  the  measurements  listed  in  Table  4-3b  have  the  worst  average 
variances.  In  addition,  the  seven  different  classes  listed  are  precisely 
those  classes  which  caused  the  greatest  number  of  errors  (Table  4-2). 

It  is  extremely  important  to  identify  the  cause  of  the  poor  performance 
for  some  subjects.  A study  has  indicated  that  there  are  three  sources  for  the 
large  variances  in  classes  10,  12,  16,  18,  20,  and  22.  In  decreasing  order  of 
importance,  the  error  sources  were  (1)  the  technicians  performing  the  manual 
marking  of  the  handprint  copies  failed  to  follow  their  instructions,  (2)  the 
copier  produced  a poor  image,  one  subject  to  extensive  mottling  and  loss  of 
entire  areas,  and  (3)  two  of  the  subjects  failed  to  press  their  hands  flush 
against  the  copier  surface.  Of  these  errors,  only  the  latter  need  concern  us 
since  hurran  inconsistencies  will  be  removed  once  automatic  feature  extraction 
te  hniques  are  employed  and  the  copier  will  be  replaced  in  the  actual  system 
by  scTie  type  of  television  tube  or  scanner.  The  third  error  source  simply 
instructs  us  that  some  mechanism  must  be  provided  in  the  final  access  system 
to  ansure  that  the  subject's  hand  is  maintained  flush  with  the  optical  system 
image  plane. 
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Measuremer.t 


Average  Variance  (10  mm  ) 


Ranking 


1 71.1  3 

2 14.6  8 

3 11.1  9 

4 125.  1 

5 42.5  6 

6 66.5  4 

7 47.9  5 

8 37.9  7 

9 74.9  2 


Table  4- 3a  Average  Variances  for  Each  Measurement 


Variance 

Class 

Measurement 

619. 

20 

6 

567. 

10 

1 

456. 

22 

4 

349. 

12 

4 

318. 

18 

9 

284. 

22 

5 

225. 

20 

5 

215. 

15 

4 

213. 

16 

6 

Table  4- 3b  Worst  Individual  Variances 
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4.2. 


CARDIOGRAMS 


In  contrast  to  the  handprint,  the  cardiogram  tracings  require  more 
extensive  processing.  However,  each  step  in  the  processing  sequence  is  auto- 
mated to  the  extent  that  the  software  required  for  an  automatic  verification 
system  can  be  written  with  minimum  effort.  The  features  selected  are  simply 
defined  and  extracted  from  each  heartbeat,  yet  the  error  estimates  obtained 
are  quite  encouraging. 

4.2.1.  Preprocessing 

A significant  quantity  of  data  is  required  to  perform  a meaningful  error 
analysis  so,  to  use  the  collected  data  to  its  fullest  extent,  each  individual 
heartbeat  is  considered  to  be  a single  event.  One  feature  vector  is  obtained 
then  from  one  heartbeat.  This  philosophy  precludes  the  possibility  of  using 
such  features  as  rhythm  and  rate  for  this  study.  In  any  subsequent  work  and 
particularly  in  a dedicated  verification  system,  such  features  may  be  exploited 
to  increase  performance.  The  feature  extraction  algorithm  presented  in  Appen- 
dix E is  designed  to  operate  on  a single  beat.  To  minimize  program  complexity 
the  algorithm  also  assumes  a relatively  sm.ooth  waveform.  The  preprocessing 
r; flares  the  data  for  the  feature  extraction. 

One  basic  method  to  low  pass  filter  the  waveform  is  to  convolve  it  with 
a wi.-,  .ow  function.  The  simplest  window  is  a rectangular  one,  and  Figure  4-6 
W..OWS  the  result  of  such  a convolution.  Note  also  that  the  waveform  has  been 
resampled  by  a factor  of  2,  since  it  was  originally  oversampled.  Other 


Figure  4-6  Smoothed  Cardiogram  Data 


windows  and  more  complicated  smoothing  techniques  were  compared  with  the 
rectangular  window,  but  none  were  found  that  performed  so  much  better  as  to 
warrant  their  added  complexity.  Figures  4-7  to  4-10  show  four  attempts  at 
using  a digital  filter  to  smooth  the  data  in  Figure  5-5. 

The  segmentation  is  accomplished  by  triggering  on  the  use  time  of  the 
leading  edge  of  the  distinctive,  quite  sharp  QRS  complex  as  shown  in  Figure  4- 
11.  When  a complex  is  located,  pointers  are  placed  at  the  proper  time  inter- 
vals both  before  and  after  it,  resulting  in  the  separation  of  that  heartbeat 
from  the  long  record.  After  the  entire  record  is  searched  and  all  the  heart- 
beats have  been  separated,  the  features  can  be  extracted. 

4.2.2.  Feature  Extraction 

The  main  characteristics  of  the  heartbeat  are  described  in  Section  D.7. 

I 

F 

[ Because  we  define  a feature  vector  from  one  beat  only  and  because  we  measure 

electrical  potential  in  only  one  configuration,  many  of  those  characteristics 
are  unusable.  A large  unmanageable  number  of  features  can  be  defined  from 
almost  any  waveform  (e.g.,  each  sample  value  can  be  a feature).  Thus  we 
cannot  initially  define  a large  feature  set  with  the  intent  to  reduce  the 
number  of  features  later,  especially  since  we  wish  to  keep  the  complexity  of 
the  feature  extraction  algorithm  to  a minimum.  Only  a few  features  were 
defined  at  first,  and  gradually  the  present  set  of  ten  features  was  decided 
upon  by  careful  study  of  distinctiveness  of  waveforms.  The  features  include 
the  five  time  intervals  and  the  five  amplitude  differences  between  adjacent 
pairs  of  the  six  points  shown  in  Figure  4-12.  Table  4-4  lists  the  ten 
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Figure  4-9  Chebyshev  8-Po1p  Filter,  Band  Elimination,  Band  Limits  55-65  Hz 
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TIME  FEATURES 


AMPLITUDE  FEATURES 


FEATURE  NUMBER 

1 

2 

3 

4 

5 


6 

7 

8 
9 

10 


MEASUREMENT- 

2-1 

3- 2 

4- 3 

5- 4 

6- 5 


(l-2)/(3-4) 

(3-2)/(3-4) 

(6-5)/(3-4) 

(5-4)/(3-4) 

3-4 


"‘Nuinl  ers  refer  to  those  depicted  in  Figure  4-12. 


Table  4-4  Ten  Cardiogram  Features 


L 
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features  in  the  form  used  in  the  logic  evaluation.  Note  that  four  of  the 


amplitude  features  are  normalized  to  the  difference  (3)-(4),  so  only  measure- 
ment 10  is  an  absolute  amplitude.  The  PARLAN  routine  EKG  presented  in  Appen- 
dix E extracts  these  10  features,  one  feature  vector  from  each  heartbeat. 

4.2.3.  Logic  Design  and  Evaluation 

The  feature  vectors  are  analyzed  in  a manner  very  similar  to  that  for  the 
handprint  vectors.  In  the  entrance  scenario,  an  applicant  requesting  access 
to  a restricted  area  inputs  a password  to  the  system,  indicating  his  assumed 
identity.  The  system  now  reads  several  heartbeats  of  the  individual,  performs 
the  necessary  processing  to  extract  the  features,  and  averages  the  feature 
vectors  together.  This  one  average  feature  vector  is  then  compared  to  the 
mean  vector  of  the  identity  class  previously  determined  by  the  applicant's 
password,  and  an  accept  or  reject  is  made. 

Note  that  unlike  the  handprints,  the  final  decision  here  is  based  on  an 
average  of  several  feature  vectors.  The  electrical  activity  of  the  cardiogram 
changes  appreciably  in  short  time  frames  (respiratory  cycle  being  a primary 
cause),  and  the  averaging  operation  minimizes  this  noise  and,  with  higher 
reliability,  obtains  a typical  feature  vector.  To  give  an  indication  of  these 
changes  Appendix  F shows  ten  heartbeats  from  the  same  person  taken  on  the  same 
day.  To  compare  this  intra-individual  variation  to  the  variation  from  person 
to  person.  Appendix  G contains  one  heartbeat  from  each  of  the  thirty  people  in 
the  data  set.  Handprints,  on  the  contrary,  are  quite  stable  in  time,  so  no 
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averaging  is  necessary.  Like  the  handprints.  Nearest  Mean  Vector  logic  is 
used  for  classification,  but  the  metric  is  the  Mahalanobis  [2]  distance.  Thus 
we  require  the  covariance  matrix  of  the  design  class. 

Since  the  processing  of  the  cardiogram  data  is  performed  automatically, 
oome  mistriggers  invariably  occur,  creating  feature  vectors  that  are  unlike 
the  norm.  To  delete  these  atypical  vectors  the  data  is  presented  to  a simple 
clean-up  algorithm.  Because  of  the  way  in  which  the  features  are  defined 
(Figure  4-12),  each  component  of  each  vector  must  be  a positive  number.  We 
. therefore  delete  any  vector  with  a negative  component.  This  method  can  be 

i 

j expanded  by  relying  on  the  medical  literature  to  provide  tighter  bounds  for 

i all  ten  measurements.  The  algorithm  simply  deletes  a vector  with  any  component 

failing  outside  the  specified  range  for  that  measurement. 

The  results  for  both  Type  I and  II  error  estimates  are  shown  in  Figure  4- 
13  and  Table  4-5.  To  evaluate  the  Type  I error,  the  data  was  evenly  divided 
into  a design  set  and  a test  set.  The  individual  design  sets  were  used  to 
obtain  class  means  and  covariances;  the  test  set  vectors  were  averaged  in 
groups  of  ten  and  these  average  vectors  applied  to  the  design  logic.  The 
results  of  each  class  were  combined  to  yield  an  overall  Type  I error  estimate. 
Because  of  the  small  amount  of  available  data,  the  Type  I error  rate  can  be 
estimated  to  at  most  + 1%.  More  data  is  required  to  show  the  true  shape  of 
the  curve. 

The  Type  II  error  is  based  upon  each  entire  class  in  turn  serving  as  the 
design  set,  and  all  other  classes  as  the  test  set,  again  averaging  each  group 
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THRESHOLD 


TYPE  I ERRORS 
Out  of  83  Attempts 


TYPE  II  ERRORS 
Out  of  4785  Attempts 


of  ten  vectors  to  obtain  one  test  vector.  The  results  for  each  class  are 
combined  to  determine  the  overall  Type  II  error  estimate.  Note  that  each 
group  of  ten  vectors  is  used  N-1  times  as  a test  attempt,  where  N is  the 
number  of  "admissibles"  (here,  N=30).  As  expected,  the  Type  II  error  rate 
increases  as  the  threshold  boundary  increases.  Because  of  the  uniform  Type  I 
error  over  the  indicated  thresholds  these  graphs  show  that  for  the  cardiogram 
data  analyzed,  a dedicated  system  can  operate  with  a threshold  as  low  as  3 and 
perform  under  the  required  specifications.  However,  a threshold  of  4 is 
probably  a more  realistic  one  based  on  the  statistical  results  of  Appendix  B. 
Thus,  we  estimate  Type  I Error  rates  at  1.2%  and  Type  II  at  1.1%. 


SECTION  5 


CONCLUSIONS  AND  RECOMMENDATIONS 


5.1.  CONCLUSIONS 

The  purpose  of  this  research  was  to  select  two  promising  physical  attri- 
butes for  in-depth  investigation  to  determine  their  potential  use  in  identity 
verification  systems.  Both  attributes  selected  show  excellent  promise.  For 

convenience  we  summarize  in  Table  5-1  the  Type  I and  II  error  rates  obtained 

* 

in  Section  4. 


I 

f 

I 


Before  considering  the  conclusions  which  can  be  drawn  from  Table  5-1  it 
is  useful  to  review  a few  key  points  in  the  data  processing  and  analysis.  The 
electrocardiograms  were  collected  in  a manner  which  attempted  to  duplicate  as 
nearly  as  possible  the  envisioned  access  system.  The  data  was  collected  with 
the  subjects  standing,  without  a ground  electrode,  with  no  electrode  paste, 
and  with  electrodes  attached  to  the  index  fingers.  Furthermore,  the  data  was 
processed  almost  entirely  automatically.  For  example,  automatic  segmentation 
and  feature  extraction  were  applied  in  order  to  obtain  the  results  of  Table  5- 
1.  This  software  could  easily  be  moved  into  a test-bed  system.  Thus,  we  have 
confidence  in  the  C-trace  results  of  Table  5-1  and  feel  they  represent  error 
rates  which  could  be  obtained  in  the  field.  Furthei  ore,  the  equipment  which 
was  used  in  the  data  collection  and  analysis  of  this  study  is  reasonably  close 
to  actual  equipment  of  a test-bed  system.  Thus,  it  appears  that  an  access 
control  system  utilizing  electrocardiograms  could  be  produced  at  a reasonable 
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Handprints 

1 

1.4%  i 1.6% 

i 

1 

C-trace  (ECG) 

1 

1.2%  1 1.1% 

i 

1 

. . 1 

• i-  '■  5-1  Error  Rates  for  Attributes  Studied 
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per  unit  cost.  On  the  other  hand,  although  the  error  statistics  of  the  C- 
trace  can  undoubtedly  be  improved,  it  is  the  authors'  opinion  that  a Type  I 
error  of  1%  and  a Type  II  error  of  .1%  probably  represent  the  ultimate  perfor- 
mance of  the  system.  This  opinion  is  based  on  the  observation  that  most  of 
the  information  content  of  the  ECG  is  already  being  extracted.  All  improve- 
ments will  probably  come  from  quantitative  improvements,  not  qualitative  ones. 

One  important  point  about  electrocardiograms  which  has  not  been  touched 
on  elsewhere  is  the  fact  that  the  waveform  shows  second-order  variability  as  a 
function  of  heart  rate.  The  encouraging  results  of  this  study  were  obtained 
with  no  special  consideration  given  to  this  problem.  However,  in  the  system 
we  envision,  the  variability  with  heart  rate  would  be  compensated.  We  propose 
to  (1)  store  approxiniately  three  records  for  each  individual,  each  repre- 
senting different  heart  rates,  and  (2)  to  measure  the  subject's  heart  rate  at 
each  entry  attem.pt  in  order  ..o  retrieve  either  the  appropriate  record  or  an 
appropriate  interpolation. 

The  handprints,  conversely,  we  believe  to  be  almost  open-ended  in  their 
ultimate  error  statistics.  First  of  all,  as  discussed  in  Section  4.1.,  the 
hands  choser  for  study  were  those  most  similar  to  one  another.  Thus,  the  Type 
II  error  rates  are  on  the  pessimistic  side.  More  importantly,  in  the  hand- 
print feature  extraction  discussed  in  Section  4,  we  have  only  utilized  a 
miniscule  fraction  of  all  the  available  lines  and  creases.  The  major  lines  of 
the  palm  are  used  only  for  deciding  where  on  the  palm  its  breadth  is  to  be 
measured,  whereas  the  minor  lines  of  the  palm  have  not  been  used  at  all. 
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Because  of  the  manual  steps  which  were  employed  in  the  feature  extraction 
performed  on  the  handprint  copies,  however,  we  must  consider  that,  at  this 
time,  we  have  only  demonstrated  that  handprints  contain  the  necessary  richness 
of  detail  to  provide  the  required  Type  I and  II  error  rates.  It  remains  to  be 
shown  that  hanJprints  can  be  digitized  and  submitted  to  automatic  feature 
extraction.  A small  effor-^  was  undertaken  to  demonstrate  that  even  a general 
purpose  digital  TV  camera  and  general  purpose  image  processing  algorithms 
could  produce  an  image  from  which  measurements  could  be  automatically  extracted. 
The  results,  described  in  Appendix  H and  shown  in  Figure  H-1,  are  quite  encour- 
aging. The  finger  crease  lines  and  the  finger  silhouette,  on  which  most  of 
the  measurements  employed  in  this  study  were  based,  are  quite  well  defined  in 
Figure  H-1.  Notice  that  even  the  writer's  callous  on  the  second  finger  is 
visible,  indicating  that  the  subject  is  right-handed.  Furthermore,  we  expect 
that  more  specialized  image  processing  software,  designed  for  this  particular 
job,  will  achieve  significantly  better  results. 

Finally,  we  would  like  to  point  out  that  the  two  attributes  chosen  for 
study  complement  each  other  nicely.  The  C-trace  we  believe  to  be  of  lower 
cost  and  of  lower  (ultimate)  performance  in  error  rates.  The  handprint  will 
probably  require  more  development,  and  access  control  by  this  method  will  be 
of  higher  per  unit  cost,  but  its  performance  can,  we  believe,  be  improved  to 
almost  any  level  desired. 
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5.2. 


RECOMMENDATION 


Based  on  the  conclusions  of  the  previous  subsection,  we  recommend  that 
development  of  both  personal  attributes  be  continued.  Both  are  ready,  we 
feel,  to  advance  to  a "test-bed"  stage.  In  the  test-bed  stage  we  would  build 
the  complete  software  package  for  automatic  digitization,  preprocessing, 
feature  extraction,  post-processing,  and  comparison  with  stored  data.  The 
output  would  be  a decision  in  near  real  time  that  the  individual's  identity 
was  or  was  not  verified.  This  software  would  be  installed  in  suitable  hard- 
ware to  permit  a real  time  extraction  of  the  physical  attribute  measurements. 
We  now  discuss  the  equipment  configuration  which  would  be  necessary  and  how 
the  test-bed  system  would  be  used. 

5.2.1.  C-Trace  Test  Bed 


The  test  bed  for  the  C-trace  would  employ  the  Hewlett-Packard  1500B 
electrocardiograph  (used  in  the  data  collection  of  Section  3)  as  its  trans- 
ducer. The  signal  processor  to  implement  the  logic  would  be  a mini-computer 
with  analog-to-digital  converter  (ADC),  digital-to-analog  converter  (DAC), 
terminal,  and  cartridge  disk  drive.  This  configuration  is  shown  in  Figure  5- 
1.  The  signal  output  of  the  electrocardiograph  would  be  digitized  at  the  ADC 
and  processed  by  the  computer.  The  computer  is  also  in  a feedback  loop  to 
determine  the  DC  bias  (Section  3.2.)  and  compensate  by  tuning  the  amplifier 
through  the  DAC.  A terminal  is  provided  for  program  control  and  to  permit  the 
entrant  to  identify  himself  to  the  system.  The  disk  serves  as  bulk  storage 


and  also  permits  programs  developed  on  larger  computers  to  be  loaded  into  the 
test  bed  computer. 

The  software  would  constitute  a complete  access  control  package.  The 
subject  would  identify  himself  by  means  of  the  terminal,  and  insert  his  index 
fingers  in  the  contacts.  The  cardiogram  would  be  processed  to  obtain  measure- 
ments which  would  be  compared  to  the  subject's  identity  record.  A decision 
would  be  made  and  the  new  record  and  results  stored.  Statistics  would  be 
compiled.  Also,  the  software  would  perform  the  operations  necessary  for 
entering  a new  subject's  file  into  the  records. 

The  preprocessing  and  feature  extraction  algorithms  would  at  first  be 
essentially  identical  to  that  described  in  Section  4.  The  test  bed  could  be 
installed  at  the  PAR  facility  in  a high  traffic  area.  A list  of  legitimate 
entrants  and  intruders  would  be  formed  from  the  personnel  who  frequently  pass 
by  the  test  bed.  Since  processing  would  proceed  in  near  real  time,  statistics 
could  be  rapidly  accumulated.  However,  we  do  not  feel  our  present  algorithms 
are  optimal.  Consequently,  after  the  system  of  Figure  5-1  is  operational,  the 
first  task  would  be  to  explore  modified  algorithms.  The  testing  of  these 
would  advance  rapidly  due  to  the  daily  monitoring  of  performance  statistics. 
Once  the  algorithms  reached  a satisfactory  level  of  performance,  modifications 
would  cease  and  extensive  statistics  would  be  compiled.  Thus,  the  test-bed 
study  would  consist  of  three  phases;  (1)  configure  hardware  and  software,  (2) 
modify  algorithms  to  enhance  performance,  and  (3)  gather  statistics  on  perfor- 
mance. 
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The  logical  next  step,  assuming  adequate  results  with  the  test-bed  sys- 
tem, would  be  brassboard  development  with  actual  components  to  be  employed  in 
the  final  system.  At  this  time  there  is  every  reason  to  believe  that  the 
processing  needs  at  the  brassboard  stage  can  be  adequately  served  with  a 
microprocessor,  a fact  which  will  greatly  reduce  final  per  unit  cost. 

5.2.2.  Handprint  Test  Bed 

We  recommend  that  the  test  bed  for  the  handprint  be  implemented  on  the 
RADC  DICIFER  system.  This  image-processing  system  contains  a digitizing 
television  camera  in  addition  to  a processor  and  a full  complement  of  peri- 
pherals. It  would  only  be  necessary  to  build  a jig  for  positioning  the  hand. 
This  jig  would  probably  also  contain  the  lighting  required  by  the  camera. 

The  same  three  development  stages  described  in  Section  5.2.1.  would  also 
apply  to  the  handprint,  with  three  exceptions.  First,  feature  extraction 
software  would  need  to  be  developed.  Second,  RADC  personnel  would  serve  as 
subjects.  Third,  since  the  DICIFER  television  camera  would  not  be  employed  in 
an  actual  system,  we  recommend  a small  task  to  study  possible  imaging  devices. 
We  feel  that  the  existence  of  a complete  image  processing  system  will  speed 
the  development  of  a handprint  identity  verification  system. 
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APPENDIX  A 


PERSONAL  ATTRIBUTES  PRELIMINARY  STUDY  GUIDELINES  AUTHENTICATION  TECHNIQUES 


A.l.  OVERVIEW 


We  are  about  to  begin  Phase  I of  the  personal  attributes  verification 
(PAV)  contract.  Phase  I is  an  examination  of  a wide  variety  of  potential 
attributes.  The  various  attributes  will  be  assigned  to  individuals  for 
preliminary  study  on  the  basis  of  the  individual's  interest,  expertise,  and 
availability.  The  two  most  promising  attributes  will  be  evaluated  through 
data  collection  and  OLPARS  tests  in  Phase  II.  Engineers  who  will  be  working 
on  this  contract  but  were  not  involved  in  preparation  of  the  proposal  should 
read  the  Statement  of  Work  and  the  first  monthly  report. 


A. 2.  PERSONAL  ATTRIBUTES  TO  BE  CONSIDERED  IN  PHASE  I 


For  the  purposes  of  the  proposal,  we  divided  the  attributes  into  three 
categories  depending  upon  whether  the  attributes  were  associated  with  the 
hand,  head,  or  other  part  of  the  body.  Table  A-1  lists  the  attributes  to  be 
considered. 


A. 3.  EVALUATION  CRITERIA 


Although  the  personal  attributes  in  Table  A-1  were  organized  according  to 
their  relation  to  the  parts  of  the  body  examined,  another  useful  breakdown  is 


Feature/ At tribute 

Engineer(s) 

Hours 

Available 

Hand 

1. 

Palm  prints 

GF,  FF,  DS 

60 

0 

Finger  folds 

GF 

30 

3. 

Finger  lengths/area 

GF 

(see  2.  ) 

4. 

Color 

GF 

(see  18.  ) 

5. 

Venous  patterns 

DL 

40 

6. 

P 1 e t by  smogr am  s 

MN 

30 

7. 

Skin  t’esistance 

MN,  JW 

10 

8. 

Total  resistance 

DL 

( see  28 . ) 

9. 

Bone  pattern  (ultrasound) 

RE 

20 

10. 

Tremor  pattern 

JW 

10 

11. 

IR  radiation  pattern 

DL 

(see  5.) 

12. 

Nail  strictions 

RE 

10 

Head 

13. 

Eye  scan  path/dilation 

GF 

20 

14. 

Eye  color 

GF 

20 

15. 

Sonic  charact.  teeth/skull 

RE 

10 

16. 

Bite  patterns 

FF 

20 

17. 

Ear  structure 

FF 

30 

18. 

Hair  color,  etc. 

GF 

10 

19. 

Electroencephalograms 

MN 

20 

20. 

Lips 

NA 

10 

Miscellaneous 

21. 

Footprints 

X 

10 

( see  1 . ) 

22. 

Sal  iva 

NA 

10 

23. 

Blood  composition 

GF 

10 

24. 

Odor 

NA,  MN 

20 

25. 

Heifiht , weight .... 

MtJ 

20 

26. 

ha  i t 

NA 

10 

27 . 

Electrocardiograms 

MN 

70 

(ECO,- 30,  Bcc-10,  rcn-20. 

DCG-IO) 

28. 

Verbal  responses 

50 

personal  history 

JM 

response  pattern 

typing  style 

JW 

29. 

Magnetic  response  o*^.  . 

and  fillings 

DL 

10 

30. 

Polygraph 

NA 

20 

Total  = 580 

Comparative  appraisal 

f.  eval. 

60 

640 

Table  A-1 


A-2 


to  categorize  the  attributes  in  terms  of  their  complexity  into  "scalar," 
"vector,"  and  "tensor"  groups.  A scalar  attribute  is  a single  number,  a 
vector  attriubte  is  a set  of  numbers  which  are  easily  expressed  in  monopara- 
metric  form,  while  a tensor  attribute  requires  two  or  more  parameters  for 
adequate  representation.  Height  and  weight  are  scalar  attributes,  waveforms 
such  as  EEC's  are  vector  attributes,  and  complex  quantities  such  as  palm 
prints  and  blood  composition  are  tensor  attributes.  From  the  vector  and 
tensor  attributes  we  shall  have  to  define  features.  In  general,  one  can  say 
that  the  more  complex  attributes  will  be  the  richer  in  detail  and  hence  the 
probability  of  defining  unique  features  is  high.  However,  the  problem  of 
digitizing  the  feature  will  be  severe  (thus  costly).  The  scalar  attributes 
need  no  feature  definition,  obviously,  and  many  of  them  can  be  easily,  reliably, 
and  inexpensively  transduced.  Individual  uniqueness,  on  the  other  hand,  will 
probably  be  quite  low.  Eventually  we  may  want  to  assemble  unrelated  scalar 


attributes  to  form  a feature  vector  which  will  have  a high  degree  of  uniqueness. 


We  will  evaluate  attributes  in  six  categories.  In  each  category,  the 
attribute  will  be  rated  by  the  researcher  on  a scale  from  zero  to  one  hundred. 
Attributes  scoring  fifty  or  less  in  any  category  will  be  eliminated.  The 
remaining  attributes  will  be  evaluated  by  taking  a weighted  sum  of  their 
scores  in  the  various  categories. 


The  categories  are  as  follows: 


1.  Separability.  Is  the  personal  attribute  rich  enough  and  repeatable 
enough  to  identify  individuals?  We  shall  be  interested  in  both  Type 


P 


I (rejecting  individuals  on  the  acceptance  list)  and  Type  II 
(accepting  individuals  not  on  the  list).  These  error  rates  are 
inversely  correlated,  so  for  the  purpose  of  this  evaluation  we  shall 
fix  Type  II  errors  at  2%  and  evaluate  only  in  terms  of  Type  I.  The 
score  of  an  attribute  will  then  be  100  minus  (an  estimate  of)  its 
Type  I error  rate. 

2.  Acceptability.  Will  the  method  of  measuring  the  attribute  be 
acceptable  to  the  users?  The  researcher  should  explain  how  the 
attribute  will  be  measured.  Then  a survey  will  be  made  to  determine 
user  acceptance. 

3.  Technological  Feasibility.  Here  simplicity  will  be  important. 
Evaluation  should  proceed  on  these  points : 


a.  Is  equipment  now  available?  (100) 

b.  Could  the  equipment  be  made  with  a small  modification 

of  available  equipment?  (90) 

c.  Large  modification?  (80) 

d.  Is  new  equipment  required?  (60) 

e.  Can  no  equipment  be  imagined?  (50) 


4.  Cost.  In  the  cost  category  we  distinguish  three  areas. 


a.  Development  costs.  Especially  important  here  is  the  cost  to 

collect  data  for  the  Phase  II  evaluation  of  the  attribute.  For 
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example,  to  measure  an  attribute  might  require  a very  expensive 
piece  of  equipment.  Since  we  have  to  collect  new  data  for 
Phase  II,  this  would  appear  as  a development  cost  to  us. 

b.  Purchase  cost. 

c.  Operating  cost. 

5.  Speed.  Our  goal  is  a process  which  accepts  or  rejects  an  individual 

g 

in  5 . Scoring  in  this  category  should  be  based  on 


60^ 

(50) 

30® 

(75) 

15® 

(90) 

5® 

(100) 

6.  Penetrability.  How  easily  is  the  system  fooled?  Think  in  terms  of 
a trained  agent  attempting  to  penetrate  the  system.  Evaluation 
should  be  based  on  the  cost  to  an  intruder  to  penetrate. 

It  is  obvious  that  to  evaluate  an  attribute  in  the  above  categories  one 
must  envision  a working  system.  How  will  the  attribute  be  measured?  To  guide 
cur  thinking  we  have  agreed  on  the  following  configuration.  The  subject  in 
question  desires  access  to  a controlled  room.  At  the  entrance  is  located  an 
"identity  lock."  The  subject  steps  into  the  lock  and  closes  a door  behind 
him.  The  attribute  is  tested  and,  if  the  subject  is  identified  as  a member  of 
the  acceptance  set,  a second  door  opens  to  permit  access.  VJe  imagine  for  the 
purpose  of  the  evaluation  an  acceptance  list  of  300  persons. 
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A.  4, 


FORMAT  FOR  REPORTING  RESULTS 


Each  person  assigned  a topic  will  assume  an  advocacy  role  in  support  of 
his  attribute.  The  evaluation  committee  will  assume  an  adversary  role. 

In  order  to  save  time  later,  each  researcher's  results  should  be  written 
up  in  a form  essentially  suitable  for  the  final  report.  The  history  of  the 
identification  technique/attribute  should  receive  perhaps  a paragraph. 

Because  of  the  fact  that  any  technique  will  be  eliminated  for  a score  of  50% 
or  below  in  any  category,  the  weaknesses  of  a technique  should  be  examined 
first . ^ ^ technique  can  be  eliminated  in  one  category,  there  is  no  need  to 

continue  research  into  the  other  categories . All  conclusions  must  be  docu- 
mented. List  references  in  accepted  fashion. 


. 5 . P.RCCEDURE 

Instructions ; 

Review  the  list  of  attributes  to  see  what  attribute  has  been 
assigned  to  you  and  note  the  alloted  time.  These  times  include  all 
general  review  and  writing  time. 

h'ote  any  attributes  for  which  you  might  have  leads,  references, 
thoughts,  or  sources  even  though  they  are  not  assigned  to  you,  and 
see  the  responsible  engineer. 
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2. 


3.  Complete  research  and  report  in  four  weeks. 


Note  that  a good  source  of  information  is  a statement  by  an  expert  (in 
the  pertinent  field  of  physiology,  etc.)  obtained  by  writing  a letter. 
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APPENDIX  B 


PARAMETRIC  CONSIDERATIONS  Of  TYPE  I AND  II  ERRORS  IH  THE  FINCCRPRINT  PROBLEM 


B.l.  INTRODUCTION 


The  fingerprint  problem  is  a particular  type  of  pattern  classification 
situation.  Given  a large  population  of  individuals,  some  personal 
attribute  is  measured  on  a day-to-day  basis.  This  attribute  should 
remain  more  or  less  constant  for  a specified  individual  and  should 
distinguish  him  from  other  individuals.  In  pattern  classification  language, 
all  the  "fingerprint"  measurements  ever  taken  on  individual  A comprise 
class  A,  the  fingerprints  of  individual  B comprise  class  B,  and  so  on. 

The  classification  problem  is  to  separate  all  the  groups  (individuals) 
and,  presented  with  a set  of  fingerprints,  to  decide  to  which,  if  any, 
of  the  knovm  individuals  the  fingerprints  belong. 

The  entry  access  problem  is  essentially  a variant  of  the  fingerprint 
problem.  From  a large  (and  for  all  practical  purposes  infinite)  population, 
P,  one  is  given  a set  of  N individuals  who  are  permitted  access  to  a 
secure  area.  Being  confronted  with  a member  of  P drawn  at  random,  one 
must  recognize  the  individual  if  he  is  one  of  the  U licensed  individuals 
and  one  must  reject  him  otherwise. 


In  either  the  fingerprint  or  entry  access  problera  it  is  frequently 
useful  to  have  a priori  estimates  for  the  richness  and  distinctness  of 
the  identifying  attribute  or  feature  one  has  chosen.  The  following 
discussion  derives  such  estimates  for  an  extremely  simple  case,  but 
it  is  hoped  that  the  expressions  obtained  will  serve  to  illustrate  the 
functional  dependence  of  the  relevant  parameters  and  to  provide  order- 
of-magnitude  estimates  of  the  worth  of  a specified  personal  attribute 
which  might  be  useful  in  trade-off  studies. 


B.2.  DERIVATION 


We  consider  a population  set  P containing  a large  number  of  individuals. 

From  each  individual,  measurenents  are  taken  to  form  feature  vector  v., 

where  i denotes  the  individual.  The  individuals  are  measured  on  a day- 

to-day  basis  and  due  to  measurement  errors  and  intrinsic  variability, 

the  feature  vector  for  the  ith  individual  is  not  alv/ays  the  same,  but 

rather  is  distributed  according  to  f^^.  The  mean  value  of  the  feature 

vector  for  the  ith  individual  we  denote  v^.  The  mean  vectors  v^  are 

assumed  to  have  distribution  F as  i ranges  over  the  members  of  P. 

The  distribution  F describes  how  much  variation  one  sees  from  individual 

to  individual,  and  we  refer  to  this  as  "interindividual  variability." 

The  distributions  f.  describe  the  "intraindividual  variability." 

1 

In  the  entry  access  problem.  II  individuals  are  placed  on  a list 
of  "Admits."  If  an  individual  drawn  at  random  from  P is  on  the 


acceptance  list,  he  is  admitted,  and  otherwise  he  is  rejected.  Due  to 


intraindividual  variability,  there  is  a (usually  small  but)  non-zero 
probability  that  an  Admit  will  be  rejected.  Such  an  error  is  called 
an  error  of  Type  I.  Also,  there  is  the  parallel  probability  that  an 
invalid  candidate,  a "Reject"  will  be  accepted.  This  is  denoted  an  error 
of  Type  II. 


Under  very  simplifying  assumptions,  we  would  like  to  estimate  the 
7^*03  1 and  Type  II  error  rates.  Also,  assuming  that  the  II  Admits  are 
drawn  at  random  from  P,  we  shall  define  a number  h*  which  measures  the 
typical  size  of  the  Admit  list. 


Our  assumptions  are  the  following: 


The  vectors  v.  are  of  dimension  A.  (The  measurements  which 
1 

form  the  feature  vector  m.ay  be  correlated,  but  it  is  assumed 
that  uncorrelated  measurements  m.ay  be  found.  Thus  A is 
the  dimensionality  of  the  space.) 


The  distributions  are  all  multivariate  Gaussians  with  the 
same  covariance  matrix  . 


i(v.  - v.)"^  r^v.  - V.) 


f.(v.)  = 


i " ■ (2  IT)"/'  (det 


n Lquation  1 "t"  and  "det"  denote  "transpose"  and  "determinant." 
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3.  The  classification  algorithm  is  to  decide  the  vector  v belongs 
to  class  i when  the  Mahalanobis  distance  from  v to  is  less 
than  k.  If  v is  not  within  k of  any  mean  vector,  the  vector  is 
rejected  and  the  candidate  is  not  admitted.  The  decision  surface 
determined  by  this  algorithm  is  a hyperellipsoid  of  volume 

’•  (SV". 

4.  The  distribution  F is  urdforra  on  a hyperellipsoid  of  volume 

V and  semiaxes  R, , R„,  ...  R . Thus, 

I-  ^ A 

''n  A 

''  ' .n/i- 

The  situation  envisioned  in  the  above  assumptions  is  illustrated 
in  t^gure  1 for  a two-dimensional  feature  space.  The  large  ellipse  is 
the  bound  of  the  uniform  distribution  F.  "The  four  smaller  ellipses  denote 
the  decision  L-oandaries  for  four  individuals. 

The  Type  I error  rate  Ej.  is  the  integral  of  f^  over  all  points 
which  lie  outside  of  Mahalanobis  distance  k from  v^.  It  is  easiest  to 
compute  the  probability  that  a Type  1 error  will  not  occur.  With  no 
loss  of  generality  we  can  put  the  mean  vector  equal  to  zero  and  carry 
out  the  integration  in  coordinates  aligned  with  the  axes  of  the  hyper- 
el'’ipse  defined  by  the  third  assumption  above, 
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(3) 


2 2 2 

2^  2^****  2 ^ 

Oi  02  O. 


where  o is  the  ith  eigenvalue  of  o and  is  the  ith  coordinate. 


*^r°i  dx.  X? 

1 = n J ^ ^ . (4) 

i=l-R  O.  2.^5  e ^ 7 

1 i2iT  2-na^ 

Equation  4 can  be  expressed  in  terns  of  the  error  function  by  straightforward 
manipulations , 


1 - Ej  = (erf  k/j2)^  . 


We  now  discuss  the  computation  of  the  Type  II  error  rate.  This  is 
an  error  which  occurs  when  an  individual  who  has  not  been  enrolled  in 
the  identification  system  is  mistakenly  classified  as  one  of  the  1.' 
people  enrolled  in  the  system.  In  general,  this  error  rate,  Ejj»  will 
depend  on  whether  a candidate  for  identification  is  requested  to  gi’'e 
his  name  or  code  number  before  the  identification  process  is  initiated. 

Me  refer  to  this  as  a "log  on"  procedure.  If  a log  on  is  required,  then 
an  intruder  would  have  to  choose  one  particular  person  in  the  system  to 
imitate.  Assuming  a "casual  intruder"  (i.e.,  randomly  chosen)  the  chances 
that  his  attribute  vector  v;ill  match  that  of  the  enrolled  person  is 
approximately  6V/V.  It,  on  the  other  hand,  no  name  or  number  is  required 
of  the  candidate,  then  the  system  itself  must  test  him  against  all  II 
individuals  enrolled  in  the  system.  The  chances  that  the  intruder  will 
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natch  any  ona  of  these  N individuals  is  thus  greatly  enhanced  and  is 
approxinately  M 6V/V.  Both  of  these  expressions  assume  that  the  volume 
of  overlap  between  individuals  enrolled  in  the  system  nay  be  igno*^d  and 
that  5V  is  small  with  respect  to  V so  that  edge  effects  are  negligible. 
From  the  above  arguments  we  have 


(no  system  log  on) 


( log  on  required ) 


Applying  Equation  2 and  an  analogous  expression  for  fiV,  Fxjuation  7 
may  be  rewritten 


.n 


i=l  Oi 


.n,  "i 

1=1 

Finally,  we  define  K*,  the  characteristic  number  of  individuals 
who  can  be  dravm  at  random  from  P and  placed  on  the  acceptance  list 
without  overlapping  decision  surfaces.  The  number  IJ*  is  an  important 
parameter  for  the  fingerprint  pxxsblen  because  the  goal  is  to  define  a 
physical  attribute  such  that  all  N people  enrolled  in  the  system  look 
different  from  one  another.  That  is,  we  have  an  N-class  problem. 

For  the  entry  access  problem,  however,  one  has  essentially  only  a 2-class 
problem:  the  candidate  is  either  on  the  list  or  be  is  not.  That  is,  it 
does  not  ratter  if  two  individuals  on  the  Admit  list  are  occasionally  con- 
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The  first  name  on  the  acceptance  list  is  drawn  with  no  danger  of 
overlap  and  can  lie  anywhere  within  V.  However,  the  second  individual 
must  be  drawn  so  that  v^  is  at  least  2k  from  v^^.  Similarly,  must 
lie  at  least  2k  from  v^  and  from  7^.  Let  p(N)  be  the  probability  that 
no  overlap  occurs  with  N individuals  on  the  acceptance  list.  Define 
N*  by 


p(N*)  = .5.  (9) 

Notice  the  similarity  of  the  above  problem  to  the  "birthday  problem" 
of  elementary  statistics.  The  birthday  problem  asks  for  the  probability 
q that  there  will  be  no  common  birthdays  among  a group  of  H persons. 

D 

Assume  there  are  exactly  365  days  in  the  year  (no  leap  years).  There 
M 

are  then  365  ways  to  arrange  the  birthdays.  There  are  365  . 364  . ... 
(365-M+l)  ways  to  arrange  the  birthdays  with  no  overlap.  That  is,  the 
first  individual  can  have  any  birthday  out  of  365,  the  second,  any  out 
of  364,  and  so  forth.  Thus, 

= 365-"  (alHwr  • 

Surprisingly  enough,  the  probability  q reaches  .5  for  only  23  people. 


Consider  the  N hyperellipsoids  of  volume  6V  v.’bich  according  to  our 
four  assumptions  are  distributed  with  random  uniform  distribution  F 
throughout  volume  V.  We  want  to  compute  the  probability  of  one  or  more 
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overlaps.  Fix  attention  on  the  first  ellipsoid.  There  are  then  H-1 
ellipsoids  which  are  also  distributed  in  uniform  random  fashion  through 
V.  The  density  of  the  remaining  ellipsoids  is  (N-l)/V.  To  create 
an  overlap  of  any  of  these  N’-l  ellipsoids  with  the  first  ellipse  requires 
that  the  center  of  the  overlapping  ellipse  lie  within  Hahalanobis 
distance  2k  of  the  center  of  the  first  ellipse.  Because  the  location 
of  each  of  the  N ellipsoids  is  an  independent  event,  we  nay  use  Poisson 
statistics  to  compute  the  probability  of  no  such  overlap,  The 

density  of  spheres  of  concern,  H-l/V  and  the  volume  of  interest,  2^  6V, 
yield 


= cxp(-(M- 


1)2  6V/V) 


(11) 


Now  fix  attention  on  the  second  ellipsoid.  The  density  of  remaining 
ellipsoids  is  (N-2)/V.  Thus,  the  probability  that  none  of  the  remaining 
II-2  ellipsoids  overlap  with  the  second,  q^  is 


q^  = exp(-(M-2)2^  6V/V). 


(12) 


Similar  expressions  hold  for  all  the  remaining  ellipsoids,  yielding 
q^,  q^,  ...  , and  q^^  The  joint  probability  of  no  overlap,  q,  is 
given  by  their  product. 


(13) 


or 
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(14) 


q = exp(-N(N-l)6  V2^  "Vv) 


Finally,  we  obtain  as  definition  of 


.5  = exp(-N*(N<'-l;2^  "^6  V/V)  (15) 


B.3.  SUMMARY  OF  RESULTS 

Assembling  our  results  we  have  from  Equation  5 for  the  Type  I 
error  rate 


Ej  = 1 - erf(k//2)^  . (16) 


For  the  Type  II  error  rate,  we  have 
A ^ 

^ .n  ‘^i 

E = 

II  A 

n R. 

i=l  ^ 

Finally,  for  the  characterstic  value  of  N, 


(17) 


.5  = exp(-IJ*(H*-l)2^  6V/V)  (18) 


B.4.  APPLICATION 

The  application  we  shall  consider  is  the  use  of  the  electrocardiogram 
(ECC)  to  identify  individuals.  Two  independent  pieces  of  evidence  show 


B-10 


that  there  are  about  50  independent  measuren-nts  which  ray  be  extracted 
from  an  ECC.  Dun,  et.  al,  (cited  in  fiacFarlar.e  and  Lawrie,  1974) 
started  with  300  r.easurements  on  each  ECG,  but  found  that  only  50 
neasurements  were  necessary  to  separate  nomals  from  all  types  of 
abnormals.  Secondly,  it  has  been  observed  that  99^  of  the  energy  of 
an  ECG  lies  in  the  first  24  harmonics  of  the  power  spectrum  (Blackburn, 
1969).  Since  two  numbers,  a sine  and  cosine  coefficient  are  necessary 
for  each  harmonic,  we  again  arrive  at  a number  of  order  5D  for  the 
intrinsic  dimensionality  of  the  measurement  space  of  an  ECG.  Thus  we 
set  A = 50. 

The  value  of  k,  which  defines  the  decision  surface,  is  determined 
through  Equation  16  once  the  Type  I error  rate  is  chosen.  Suppose  we 
pick  an  error  rate  of  0.01.  Then  k is  roughly  3.73. 

V/e  would  now  like  to  evaluate  the  Type  II  error  rate.  Simonson, 

ct.  al.  (1949)  have  gathered  statistics  on  individual  variability  and 

range  of  ECG  measures  among  the  normal  population.  In  order  to  apply 

2 

Equation  17  directly,  we  would  need  to  know  the  variances  o . of  fifty 
independent  measurements.  Ue  also  need  the  ranges  which  may  be  given 
for  fifty  different  measurements.  From  the  work  of  Simonson,  et . al. 
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(1949)  we  have  only  35  measurements  reported.  Furthermore,  we  have  no 
guarantee  of  the  independence  of  these  measurements.  Nevertheless, 
we  proceed  as  if  the  measurements  were  independent  and  take  the  standard 
deviation  of  the  intraindividual  variation  as  o^.  Simonson,  et  al 
report  the  standard  deviation  of  the  interindividual  variation.  To 
obtain  an  estimate  of  we  set  R^  equal  to  Vs  of  the  reported  inter- 
individual standard  deviation  since  a uniform  distribution  of  extent 
+\/3s  has  a standard  deviation  of  s.  The  data  taken  from  Simonson  et 
al  is  assembled  in  Table  B-1.  From  Equation  17  it  is  clear  that  kO^/R, 
must  be  smaller  than  one  if  the  ith  measurement  is  to  be  of  much  use 
in  distinguishing  individuals.  Fourteen  of  the  entries  in  Table  1 
have  O./R.  > 3.73.  Let  us  suppose  that  these  features  are  eliminated 
so  that  we  are  reduced  to  21  features.  Now  a Type  I error  rate  of 
.01  implies  R = 3.51.  Evaluating  Equation  17  from  Table  B-1  yields 


■'ll 
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To  evaluate  N*  for  ECG  measurements  we  turn  to  Equation  18.  It 
is  immediately  apparent  that  any  measurement  for  v/hich  2k  >R^  will 
not  contribute  to  a favorable  value  of  N*.  Returning  to  Table  B-1  we 
find  even  fewer  measurements  v/hich  satisfy  this  restriction.  Let  us 
suppose  that  only  the  ten  best  measurements  are  chosen,  namely  3,  4, 

5,  10,  14,  22,  23,  24,  25,  and  33.  In  Figure  B-2  we  present  a plot  of 
E^  and  as  a function  of  k for  these  ten  measurements.  For  purposes 
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of  comparison,  graphs  of  and  are  also  given  in  Figure  B-2  for 
A =5  and  2.  The  crossover  point  of  E^  and  E^j  for  A=10  occurs  near 
k=3.5.  Assuming  tnis  value  of  k,  we  obtain  from  Equation  18  a value 
of  N*  near  unity.  Thus,  ECG  measurements  appear  to  be  unsuitable  for 
fingerprint  purposes  but  potentially  useful  in  regard  to  entry  access. 


Table  B-1 


Limb  Leads  [amplitudes  in  units  of  .Ir.V] 


Feature  name 

VT  ' interir.dividual 

intra individual 

standard  deviation 

standard  deviat: 

1 

^2 

.421 

.141 

2 

3.43 

.548 

3 

7.41 

.64 

4 

^3 

9.11 

.83 

5 

15.12 

1.49 

^QRS 

6 

RS-T^ 

.294 

.152 

7 

RS-T^ 

.346 

.182 

8 

RS-T3 

.416 

.155 

9 

^1 

1.58 

.387 

10 

'^2 

3.10 

.439 

11 

•^3 

1.97 

.443 

12 

5.66 

.814 

Axis  [degrees] 

13 

QRS 

28.6 

6.56 

14 

T 

69,3 

9.99 
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Intervals  [.01  seconds] 


15 

R-R 

22.9 

8.59 

16 

A MAX-MIN 

RR  11.95 

5.4 

17 

P-R 

4.U4 

,854 

18 

QRS 

2.2; 

.400 

19 

*^QT 

.Uio 

.015 

20 

’^SVST 

.029 

.011 

Chest  leads  [ . 

ImV] 

21 

R-CF^ 

.727 

.27 

22 

R-CF^ 

4,22 

.58 

23 

R-CF^ 

12.52 

1.60 

24 

S-CF^ 

10,17 

1.31 

25 

S-CF^ 

15.84 

2.27 

26 

S-CF^ 

6.39 

1.30 

27 

RS-T-CF^ 

.61 

.19 

28 

RS-T-CF^ 

1.04 

.44 

29 

RS-T-CFj^ 

,97 

.35 

30 

T-CF^ 

2 . 44 

.57 

31 

T-CF^ 

3 . 36 

.84 

32 

T-CF^ 

3.43 

.86 

33 

R/S-CF^ 

.16 

.02 

34 

R/S-CF^ 

.31 

.05 

35 

R/S-CFj^ 

9.92 

3.05 
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PCRS'  NAL  attributf:  study 
ACCEPTABILITY  ANALYSIS 


One  vital  factor  in  the  selection  of  a personal  attribute  for  identi- 
fication purposes  is  the  acceptability  with  which  a particular  measurement 
technique  is  received.  This  study  is  an  attempt  to  evaluate  users'  impres- 
sions as  to  the  acceptability  level  of  a set  of  these  measurement  techniques. 

Subjects  were  given  a booklet  containing  an  instruction  sheet  and  a 
set  of  16  hypothetical  identification  situations.  They  were  to  simply  read 
the  description  of  a particular  situation  and  rate  it  in  terms  of  accept- 
ability on  a scale  from  1 to  10.  Two  examples  (personal  recognition  by  a 
guard  and  the  analysis  of  blood  and  urine  samples)  were  provided  to  provide 
a standard  context  in  which  to  rate  the  remaining  situations.  (A  copy  of  the 
booklet  is  attached.) 

Subjects  were  all  employees  of  PAR  and  consisted  of  6 females 
(secretaries  and  clerical  personnel),  5 males  from  the  Personal  Attribute 
Group  (scientists  and  engineers),  and  15  additional  males  selected  at  ran- 
dom (programmers  and  other  technical  personnel). 

It  was  determined  a priori  that  the  three  groups  of  subjects  would  be 
analyzed  separately.  (The  statistical  evaluation  of  inter- individual  vari- 
ability was  not  attempted  due  to  the  lack  of  available  analytic  routines.) 
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Means  anti  standard  deviations  were  collected  across  subjects  (within  p.roups) 
for  each  situation,  and  are  shown  in  Table  C-1.  Although  two  situations  were 
included  as  anchors  (Badge  and  X-Ray),  the  numbers  in  the  table  should  be 
int  er'preted  as  relative  to  one  another. 

Tlie  situations  are  ranked  in  the  table  in  order  of  their  acceptability 
as  lated  by  the  15  males.  The  standard  deviations  reflect  the  consistency 
ot  r.ttings  within  a group.  Noti'  «.  that  the  measurement  of  nail  grooves 
for  the  females  has  a mean  rating  wt  5.50,  and  a standard  deviation  of  3.73, 
inipl\  ing  that  there  was  substantial  d isagi'eement  in  terms  of  fhe  acceptability 
of  ll)is  measurement.  Also,  the  mean  standard  deviation  for  the  personal 
atti'ibute  group  was  (statistically)  lower  than  for  the  other  groups.  In 
addition,  their  mean  ratings  were  lower.  The  implication  is  that  this  group 
was  more  united  in  their  ratings,  and  furthermore  tended  to  rate  the  measure- 
ments as  more  acceptable  than  the  other  two  grouns  of  subjects. 

Some  general  trends  can  be  inferred  from  the  data.  Across  groups,  the 
subjects  tended  to  prefer  procedures  that  were  very  fast  and  inherently  passive. 
In  this  regard,  hair  color,  height /we ight , and  flashing  a badge  were  all  very 
acceptable  (but  the  females  were  not  quite  so  happy  with  the  height/weight 
measurement).  Subjects  were  happy  with  the  photoplethysmograph , if  they  did 
not  need  ro  attach  a clip  to  their  ear.  The  females  did  not  like  the  finger- 
nail measurement  (perhaps  because  they  could  not  use  nail  polish). 

Slightly  less  acceptable  are  procedures  which  are  perceived  as  requiring 
tior-  time.  BCH,  hand  tremors,  and  typing  a name  fall  in  this  group.  Despite 
their  slightly  lower  acceptability  ratings,  thev  are  certainly  viable  candi- 
dates. Stronger  reactions  can  be  seen  against  measurements  requiring 
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electrodes,  or  the  use  of  the  face,  ear,  etc.  (e.g.,  bite  pattern,  EKG, 
ear  ridges).  Perhaps  surprisingly,  the  question/answer  routine  was  quite 
unacceptable.  Time  was  an  obvious  factor  here. 

Overall,  the  eight  top  procedures  in  the  table  appear  to  be  reasonably 
acceptable  to  these  subjects.  (A  possible  exception  is  tJie  nail  groove 
analysis  for  the  females.)  A word  of  caution  is  in  onier,  thougti.  Every 
subject  in  this  study  has  a security  clearance,  all  have  been  briefed  at 
some  time  as  to  the  importance  of  maintaining  national  security,  and  all 
have  worked  on  military  related  projects.  Thus  it  is  quite  possible  th.it 
these  people  are  predisposed  to  accepting,  an  ident if ication  procedure  that 
other  people  would  find  er, ’■irely  unacceptable.  Moreover,  all  the  subjects 
were  white  collar,  skilled,  highly  skilled,  or  professional  people.  How 
other  classes  of  people  would  react  to  the  various  procedures  is  an  open 
question.  For  example,  how  would  a janitor,  who  happens  to  he  functionally 
illiterate,  react  to  a procedure  where  he  was  required  to  type  his  name? 

How  would  someone  with  cerebral  palsy  to  the  hand  tremor  measurement?  Or 
someone  confined  to  a wheelchair  to  the  he ight/weight  measurement?  It 
appears  that  for  any  of  these  methods  to  be  acceptable,  the  target  user 
population  must  be  explicitly  acknowledged  and  analyzed  in  detail. 
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NAMr 

INSTRUCTIONS  FOR  TDENTinCATION  STUDY 

In  dealing  with  certain  aspects  of  military  and  governmental  operations, 
security  of  areas  is  an  important  consideration.  National  security  necessarily 
requires  that  access  to  certain  locations  (tor  example,  a vault  containing  secret 
documents  or  a laboratory  for  weapons  research)  be  limited  to  specific  indi- 
viduals. Now  in  order  for  these  people  to  gain  admission  to  a secured  location, 
there  must  be  some  way  of  positively  identifying  the  people.  There  are  two 
aspects  to  the  problem.  A procedure  must  recognize  those  people  entitled  to 
enter  with  a minimum  of  delay  and  inconvenience.  Likewise,  the  procedure  must 
correctly  recognize  people  not  entitled  to  enter-  the  area. 

The  purpose  of  this  study  is  to  evalviate  several  possible  types  of  identi- 
fication procedures  in  terms  of  user  acceptability.  Consider  that  you  are 
required  to  enter  a secured  area  as  part  of  your  job.  A certain  amount  of 
inconvenience  will  necessarily  be  encountered  in  the  process  of  gaining  access 
to  the  area.  For  exa'nple,  at  one  extreme  you  might  only  have  to  be  seen  by  a 
guard  who  will  recognize  you  (and  say  "Hood  morning”).  At  the  other  extreme, 
you  might  be  required  to  submit  to  a blood  and  urine  analysis  for  positive 
identification.  Obviously,  these  two  e^.amples  are  quite  different  in  terms  of 
their  level  of  acceptability  by  the  person  br>ing  identified.  In  fact,  some 
procedures  might  be  so  unacceptable  that  a person  might  resign  from  his/her 
position  rather  than  submit  to  the  procedure. 

Selow  is  a set  of  identification  procedures.  You  are  to  read  a procedure 
and  then  rate  it  on  a scale  from  1 to  10  in  terms  of  how  acceptable  it  is  to  you. 
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If  a procedure  is  totally  acceptable,  it  should  receive  a rating  of  1.  If 
it  is  totally  unacceptable,  it  should  receive  a rating  of  10.  Intermediate 
degrees  of  acceptability  should  receive  correspcnding  ratings.  In  the  above 
examples,  the  guard  recognition  procedure  might  receive  a rating  of  1,  implying 
that  it  is  a totally  acceptable  identification  technique.  The  blood  and  urine 
analysis  might  receive  a rating  of  10,  implying  that  it  is  a totally  unaccept- 
able procedure.  Remember  that  acceptability  is  an  overall  term  covering  such 
aspects  as  inconvenience,  physical  discomfort  or  injury,  psychological  dis- 
comfort or  injury,  embarassment , etc.  You  should  interpret  acceptability  as 
reflecting  these  factors  and  any  other  factors  which  you  feel  are  important. 
Please  take  time  to  completely  consider  each  procedure. 

NOTE:  Each  procedure  will  describe  what  is  being  measured,  observed,  etc., 

and  what  the  situation  will  look  like  from  the  point  of  view  of  the  person 
being  measured.  In  each  case,  the  measurements  obtained  are  compared  against 
measurements  previously  obtained  from  you  in  an  intiialization  procedure,  and 
if  these  measurements  correspond  to  the  predetermined  values  (for  you),  you 
are  allowed  to  enter.  The  time  required  for  any  procedure  is  typically  short: 
often  only  a few  seconds  and  always  less  than  30  seconds. 


Example  1. 


A guard  looks  at  you.  His  recognition  of  you  will  allow 
you  to  enter. 


Rating 


Example  2. 

A medically  trained  attendant  inserts  a needle  in  your 
arm  to  obtain  a blood  sample.  You  are  then  asked  to  go  into  a room 
and  urinate  into  a paper  cup.  You  hand  the  cup  to  the  attendant  who 
then  puts  both  samples  into  a machine.  The  machine  measures  various 
components  of  the  two  samples  in  the  process  of  positively  identifying 
you.  ('’ote  that  this  procedure,  as  well  as  most  of  the  other  procedures 
discussed  here,  will  take  into  consideration  the  day-to-day  variations 
in  the  measurements.) 

Rating 


Process  1. 


You  clip  an  electrical  contact  on  each  ear.  (The  clips  are 
like  weak  sprinp.-type  clothespins,  and  no  electricity  will  be  flowing 
through  them.)  You  then  place  two  fingers  on  surfaces  containing 
additional  electrical  contacts.  The  contacts  in  the  surfaces  and  in  the 
ear  clips  are  used  to  pick  up  your  individual  heart  boat  (your  EKG). 

Rating 

Process  2. 

A fle.xible,  sterilized  mouthpiece  (similar  to  those  used 
by  athletes)  is  sitting  in  front  of  you.  You  pick  it  up,  place  it 
in  your  mouth,  and  bite  down.  Sensoi's  in  the  mouthpiece  then  measure 
your  individual  bite  pattern. 

^ Rating 

Process  d. 

You  walk  between  two  vertical  surfaces  and  stand  still 
for  a short  time.  An  X-rav  of  your  body  is  taken  and  used  to 
identify  you. 

Rating_ 

Process  4. 

You  place  two  fingers  on  surfaces  containing  electrical 
contacts.  You  then  look  through  a device  which  resembles  a pair 
of  binoculars.  The  contacts  in  the  surfaces  and  in  the  binocular 
device  are  used  to  pick  up  your  individual  heart  beat  (your  EKG). 

Rating 
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Process  5. 


You  walk  over  to  a specific  area  on  the  floor,  stand  still, 
and  hold  your  breath  for  3-5  seconds.  The  vibrations  of  your  lx>dy 
are  picked  up  by  sensors  in  the  floor  and  are  used  in  your  identification. 

Ra  t ing 


Process  6. 

This  procedure  recognizes  you  by  measuring  the  light  pass- 
ing through  your  fingers  (similar  to  the  red  light  which  is  seen 
passing  through  your  hand  when  a flashlight  is  shined  on  your  hand 
in  a dark  room).  You  place  the  index  finger  from  each  hand  on  two 
surfaces.  Each  surface  contains  a small  light  source  and  a sensor. 

The  light  reflected  off  your  fingers  is  then  measured. 

Rating 


Process  7. 

You  sit  in  front  of  a computer  terminal  consisting  of 
a typewriter  keyboard  and  a TV.  You  are  asked  a short  set  of  ques- 
tions about  your  private  life  such  as:  What  is  your  dog's  name,  or 
What  is  your  mother's  maiden  name.  Each  time  a different  set  of 
questions  is  asked.  In  addition,  if  you  feel  that  such  questions 
are  an  invasion  of  your  privacy,  you  may  answer  fictitiously.  The 
only  requirement  is  that  your  answers  be  consistent  each  time  the 
same  question  is  encountered. 

Rating 
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Process  8. 


You  place  the  index  finger  of  each  hand  in  two  grooves 
on  a surface  such  that  your  palms  arc  facing  upward.  A TV  camera 
under  the  surface  takes  a picture  of  the  fingernail  of  each  index 
finger.  The  very  small  grooves  in  your  fingernails  will  be  measured 
and  analyzed  in  the  same  way  that  fingerprints  are  measured.  (There 
can  be  no  polish  on  the  nails  of  the  index  fingers. ) 

Rating 


Process  9. 

You  sit  in  front  of  a typewriter  and  type  your  name  and 
a code  word.  The  rhythm  pattern  of  your  typing  is  the  measurement. 

It  does  not  matter  whether  or  not  you  are  a touch  typist. 

Rating 


Process  10. 

A sensor  in  the  ceiling  measures  the  color  of  your  hair. 
Variations  due  to  dampness,  sun  bleaching,  etc.  are  taken  into 
consideration  in  comparing  your  hair  color  to  previous  measurements. 

Rating 


Process  11. 

You  sit  down  and  look  through  a device  which  resembles  a 
pair  of  binoculars.  This  places  your  head  in  the  proper  position. 

When  you  are  positioned,  a TV  camera  will  take  a picture  of  your  ear. 
The  ridges  and  valleys  of  your  ear  lobe  will  be  measured  as  part  of 
this  procedure.  (If  your  hair  covers  your  ear,  you  will  be  required 
to  hold  it  back  so  that  your  ear  is  completely  exposed.) 

Rating 
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Procer.s  12. 

You  pick  up  a pencil-like  flashlip.lit  and  hold  it  in 
your  hand.  You  then  point  the  1 ip.ht  at  a tarpet  for  a few  seconds. 

The  slight  movements  of  your  hand  will  be  measur»‘d  by  photosensors 
in  the  tarpel. 

Rat inp 

Process  Id. 

Thi^;  procedure  recognizes  you  by  measui'inp  t'le  light 
pasr.inp  through  your  fingers  (similar  to  the  retl  light  which  is 
seen  passing  through  your  hand  when  a flashlight  is  shined  on 
voui-  hand  in  a dark  T'oom).  You  clip  two  contacts  to  your  ears. 

(The  clips  are  like  a weak  spring-tvpe  c lotht'sp  in . ) You  then 
place  the  index  finger  from  (>ach  liand  on  two  surfaces.  P.ach 
ear  clip  and  each  surface  cent. tins  a small  light  source  and  a 
sensor.  Tlie  light  reflected  off  your  earlobes  and  fingers  is 
then  measured  by  tfie  sensors. 

Rat  inp 

i'rocer.c  lu. 

Your  heii'.ht  and  weight  are  automatically  measured.  Tlie 
floor  on  which  vou  are  standing  contains  a scale,  and  the  walls  con- 
tain pfiotocells  for  measuring  your  height. 

Ra  t i ng 


J 
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Pi’ocess  15. 


This  procedure  invT'''e:'  measur' iii)’  the  elerti-ical  acliv  . in 
your  brain  after  you  see  a light  fiash.  You  first  cl  ip  an  elec  ical 
contact  on  voui'  ear.  (The  clip,  is  like  a weak  sprinp,-type  dor  liespii' , 
and  no  electr'ieity  will  be  1 lowing  through  it.)  You  then  loot  i hrougli 
a device  wliieh  resembles  a pair  of  binoculars.  You  will  see  .1  short 
(but  not  intense)  flash  of  light.  The  electrical  contact  will  pick  u; 
the  activity  in  your  brain  as  a result  of  seeing  the  flash  of  ] igiit  . 
(Note  that  no  pain  is  involved.) 

Ra  t i ng 

Process  16. 

You  are  wearing  a badge  with  your  name  and  picture  on  it. 

A guard  sees  that  your  face  matches  the  face  in  the  badge  picture  and 
that  your  name  is  on  his  list  of  people. 

Rat  inc 


Any  comments  you  have  concerning  the  acceptability  of  any  of  the  above 
procedures  will  be  most  welcome.  Simply  indicate  the  procedure  number(s) 
and  your  comments  on  this  sheet. 
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APPENDIX  D 


INITIAL  STUDY  OF  CANDIDATE  PERSONAL  ATTRIBUTES 


D-1 


D.l. 


FLEXION  CREASES 


"It  has  long  been  said  that  it  is  impossible  to  find  two  leaves  exactly 
alike:  Nature  never  I'epeats.  Choose  no  matter  what  part  of  the  human  body; 

examine  it  and  compare  it  with  care  in  different  subjects,  and  the  points  of 
dissimilarity  will  seem  to  you  the  more  numerous  the  more  minute  your  examin- 
ation, "[l] 

This  quote  from  Bertillion,  a well-known  criminologist  and  student  of 
identification  techniques  whose  work  preceded  the  development  of  modern 
fingerprint  methods,  justifies  the  search  for  additional  attributes  that 
might  be  used  for  personnel  verification.  This  note  suggests  the  investi- 
gation of  the  flexion  creases  of  the  hand  as  one  such  attribute. 

"As  there  are  no  two  natures  alike,  so  there  are  no  two  hands  alike." 
Cheiro  [2j 

Cheiro’s  statement  regarding  the  palmist's  grist  - the  flexion  creases, 
or  lines  of  the  palm,  that  have  common  names  such  as  "life  line,"  - serves 
to  alert  us  to  the  possibilities  of  their  use  in  personnel  verification. 

His  attention  to  detail  has  provided  a rich  description  of  the  variability 
of  such  lines. 

What  is  .1  flexion  ■ rease?  Dorand'a  Medical  Dictionary  [3]  gives  the 
following  iefinition: 


D-2 


"Any  of  the  normal  grooves  across  the  palm  which  accommodate  flexion 
(the  act  of  bending  or  condition  of  being  bent)  of  the  hand  by  separating 
folds  of  tissue." 

In  order  to  describe  the  geometric  patterns  of  flexion  creases  (palmar 
creases,  if  they  occur  on  the  palm),  a few  definitions  are  introduced  now 
that  are  used  to  describe  the  general  anatomy  of  the  hand.  Figure  D-1 
shows  the  bones  of  the  hand  in  outline  form.  Note  the  order  of  the  numbering 
of  the  thumb  (I)  and  fingers  (II-V).  The  phalanges  (finger  bones)  are 
labeled  "proximal,  middle,  and  distal"  in  order  of  increasing  distance  from 
the  metacarpus  (the  part  of  the  hand  between  the  wrist  and  the  fingers).  The 
bones  of  the  hand  are  comprised  of  the  fourteen  ossa  digitorum  manus  (five 
proximal  phalanges,  four  middle  phalanges,  and  the  five  distal  phalanges) 
of  the  thumb  and  fingers,  the  five  ossa  metacarpal ia  of  the  metacarpus  and 
the  eight  ossa  carpi  of  the  carpus  (wrist). 

The  flexion  of  the  fleshy  part  of  the  hand  is  constrained  to  occur  at 
the  joints  between  the  bones,  of  course.  The  resulting  flexion  creases  that 
manifest  themselves  in  the  kin  are  generally  related  to  such  motion  and  can 
be  found,  to  first  order,  in  predictable  locations.  Thus,  there  are  usually 
'Si.  or  two  transverse  creases  associated  with  the  joint  between  the  middle 
ind  distal  phalanges,  two  or  three  creases  associated  with  the  joint  between 
the  proximal  and  middle  phalanges  and  two  or  three  creases  associated  with 
’ ■ joint  between  the  metacarpal  and  proximal  phalange  for  each  finger.  In 
■'dition,  there  ar>-  .-everal  palmar  creases  that  are  found  in  common  locations 
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Figure  D-2  is  a schematic  representation  of  the  surface  of  the  palmar 
side  of  the  hand  showing  the  usual  location  of  the  flexion  creases  and  a 
number  of  other  flexure  lines  and  features  of  the  skin's  surface.  Some 
additional  terminology  is  introduced  at  this  point  for  future  use.  With 
respect  to  the  major  flexion  creases  of  the  palm,  "proximal"  and  "distal" 
refer  to  distance  from  the  thumb  across  the  width  of  the  palm.  "Transverse" 
and  "longitudinal"  refer  to  the  orientation  of  a line  on  the  palm  with 
respect  to  the  hand,  with  transverse  being  across  the  hand  (from  the  thumb 
to  the  palm  margin)  and  longitudinal  along  the  length  of  the  hand  (parallel 
to  the  fingers). 

There  are  three  major  flexion  creases  of  the  palm: 

1.  Radial  Longitudinal  Crease 

2.  Proximal  Transverse  Crease 

3.  Distal  Transverse  Crease 

These  are  shown  as  thick  lines  in  Figure  D-?.  Either  the  Radial  Longi- 
tudinal Crease  (the  palmist's  Line  of  Life),  the  Proximal  Transverse  Crease 
(Line  of  Head)  extend  separately,  or  they  join  together  (as  shown)  before 
re.^1'  hing  to  the  thumb  side  of  the  palm,  or  proximal  margin.  The  Distal 
Tran  .vurse  Crease  (Line  of  Heart)  usually  extends  to  the  distal  margin  of  the 
palm.  Table  D-1  summarizes  the  locations  of  these  (and  other)  flexion 
•reaves  commonly  fovind  on  the  palm.  Also  listed  in  Table  D-1  is  the  joint 
fle;-;ure  that  is  most  strongly  associated  with  each  crease.  For  example. 
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Friction  Ridges 


V 

J 


Longitudinal 


Age  Crease 


J lexion  Crease 
(at  joint) 


flexion  Crease 

( intra-phalanx ) 

Meta  carpo- 
phalangeal  crease 

Friction  Ridge 

Proximal  Margin 

Distal  Transv. 

Crease 


Distal  Margin 

Fh'<->ximal  Transv 

Crease 

Stretch  Lines 

f Additional 

Creases 

Radial  Longi- 
tudinal Crease 


Transverse 


Figure  D-2a  Surface  Attributes  of  the  S)<in  of  the  Palmar 
Side  of  the  Hand 


ilTO 


LETTER 

CREASE  NAME 

ASSOCIATED  FLEXURE 

( Scientific /Palmistry ) 

JOINTS 

a 

Secondary  Radial  Longitudinal 
"Line  of  Mars" 

Firsi-  Meta-Carpaie/ 

Carpale 

i 

1 

b 

Primary  Radial  Longitudinal 
"Line  of  Life"  (if  on  left  hand) 

First  Meta-Carpale/ 

Carpale 

i 

j 

c 

Primary  Proximal  Transverse 
"Line  of  Head" 

Proximal  Phalanges/ 
Meta-Carpales 

) 

1 

d 

Secondary  Proximal  Transverse 
"Girdle  of  Venus" 

Proximal  Phalanges/ 
Heta-Carpales 

e 

Primary  Medial  Longitudinal 
"Line  of  Fate" 

First  and  Fifth  Meta-Carpale/ 
Carpale 

f 

Secondary  Medial  Longitudinal 
"Line  of  Sun" 

First  and  Fifth  Meta-Carpale/ 
Carpale 

i 

g 

Tertiary  Medial  Longitudinal 
"Line  of  Health" 

First  and  Fifth  Meta-Carpale/ 
Carpale 

h 

Secondary  Distal  Transverse 
"Line  of  Marriage" 

Fifth  Proximal  Phalange/ 

Fifth  Meta-Carpale 

i 

i 

Primary  Distal  Transverse 
"Line  of  Heart" 

Third,  Fourth,  6 Fifth 
Proximal  Phalanges/Meta- 
Carpale 

]■ 

Carpale  Transverse 
"Bracelet" 

Carpales  (wrist )/Ulnar  farm) 

Table  D-l  Cr-^ase  Names  and  Associated  Joints 
C See  Figure  D-2b  for  Locations) 
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flexure  at  the  r,etacarpal/proximal  phalange  joints  of  fingers  III,  IV  and  V 
would  be  associated  with  the  Distal  Transverse  Crease. 

Figure  D-2  also  shows  the  existence  of  additional  attributes  of  the 
skin  surface  on  the  palmar  side  of  the  hand.  The  most  commonly  used  method 
of  positive  identification  today  is  fingerprinting  which  makes  use  of  the 
unique  combination  of  patterns  of  friction  ridges  at  the  fingertips.  The 
whorls,  loops,  arches  and  minutia  form  a permanent,  imbedded  dernwitoglyphic 
signature  that  doesn't  (organically)  change  from  birth  to  death  in  its 
topology  [4,  5,  6].  As  is  well  known,  fingertip  friction  ridges  have  been 
collected  manually  by  ink  transfer  imprints  by  such  agencies  as  the  Federal 
Bureau  of  Investigation  (FBI)  and  almost  every  local  law  enforcement  depart- 
ment. 


Automatic  scanning,  retrieval  and  matching  systems  are  being  developed 
by  the  FBI  and  such  companies  as  Sperrv  Rand  Corporation,  Rockwell  Inter- 
national and  Calspan  Corporation.  A Calspan  unit  was  to  have  been  tested  for 
the  Base  and  Installation  Security  System  at  Fllsworth  Air  Force  Base  under 
the  CAVEAT  program.  The  following  quotes  from  the  FBI  Law  Enforcement 
Bulletin,  December  1961  (revised  March  1969)  underscores  their  belief  in  the 
utility  of  this  attribute. 

"Of  all  the  technical  procedures  employed  in  criminal  investigations, 
none  exceeds  the  potential  value  of  the  latent  fingerprint  examination.  By 
this  means  alone,  many  crimes  have  been  solved  and  the  perpetrators  identi- 
fied beyond  all  doubt. 


The  positive  nature  of  fingerprint  identification  is  based  on  the 
following  two  facts  which  have  been  established  through  observation  for  many, 
many  years : 

1.  Every  finger  of  every  person  bears  a ridge  arrangement  which  is 
unique . 

2.  Barring  cases  of  accidental  or  surgical  removal,  this  pattern  is 
permanent  for  the  life  of  the  individual  and  endures  until  decom- 
position of  the  skin  after  death." 

Because  of  existing  programs  utilizing  fingerprints  as  the  personal 
attribute,  the  Statement  of  Work  for  this  effort  specifically  excluded  it 
from  our  investigation.  The  next  sentence  in  the  FBI  bulletin  says,  however: 

"These  statements  are  true  also  of  the  ridges  on  the  palms  of  the 
h.inds  and  on  the  toes  and  solos  of  the  feet.  Identifications  of  these 
areas  have  the  same  technical  and  legal  validity  as  fingerprint  identifica- 
tions." 


Indeed,  considerable  analysis  of  friction  ridge  patterns  on  palms 
and  soles  have  been  made  in  addition  to  those  of  the  fintertips  [6,  7,  8]. 
Palm  j.fints  have  been  used  in  the  study  of  schizophrenia  [9,  10,  11]  and 
•.h»T  genetic  disorders  [12].  Palmar  flexion  creases  have  been  suggested 
a iiidicatcis  in  Down's  syndrome  and  leukemia  as  well  [13].  Because  schiz- 
oilironia  [l^)  and  Down's  syndrojne  [3]  have  suggested  as  having  genetic 
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origins,  and  dermatological  features  such  as  friction  ridges  and  flexion 
creases  also  are  considered  to  be  genetically  determined  [4],  it  is  natural 
to  search  for  a correlation  between  these  disorders  and  the  patterns  of 
ridges  and  creases. 

Congenitally  formed  attributes  are  of  particular  interest  to  this 
project  because  they  exist  from  birth,  tend  not  to  change  drastically  or 
rapidly  with  age,  and  may  be  unique  to  the  individual. 

The  hand  surface  is  rich  in  such  characteristics.  Montagna  [4] 
states : 


"...  ridges  in  the  palms  and  soles,  inherent  flexion  lines 
and  the  countless  fine  lines  over  the  entire  surface  of  the 
skin  are  all  congenitally  formed." 

Congenitally  formed  lines  are  not  the  only  lines,  however,  as  it  is 
commonly  known  that  wrinkles  and  furrows  develop  with  age  and  use.  However, 
this  is  believed  to  be  a slow  process  which  could  be  tracked,  if  necessary, 
with  regular  updating  of  the  reference  data  stored  for  each  individual.  It 
might  also  indicate  to  some  extent  the  environmental  conditions  that  each 
individual  was  exposed  to  during  his  or  her  prior  years  that  influenced  the 
formation  of  such  wrinkles  and  which  might  further  aid  the  personnel  veri- 
fication process.  Flexion  creases,  however,  are  permanent  attributes  as  they 
indicate  the  locus  of  points  at  which  the  skin  has  a firmer  anchoring  to  the 
subcutaneous  tissue.  They  also  tend  to  show  the  arrangement  of  the  collagen- 
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ous  fibers  in  the  dermis.  Thus,  they  form  a pattern  of  lines  on  the  hand 
that,  particularly  when  stretched,  can  possibly  be  differentiated  due  to 
a color’  difference  caused  by  the  presence  and  absence  (at  the  crease)  of 
col  lap, ea  in  the  lower  layers  of  the  skin.  With  the  absence  of  much  pigmen- 
tation on  the  palmar  side  of  the  hand,  the  epidermis  (top  living  layer  of 
the  skin)  tends  to  be  translucent. 

Visual  inspection  of  the  lines,  e.p.  flexion  creases,  of  the  hand 
revf’al  many  types  of  loatur’os  that  characterize  them,  figure  D-2b  shows  the 
location  of  possible  crease  lines  (a,  b,  ...,  i).  The  most  conunon  of  these 
are  b (r.idial  longitudinal),  c (proximal  transverse),  i (distal  transverse) 
and  i ( ai’pale  transverse).  Often,  the  radial  longitudinal  crease  will  be 
t'omrlctely  separ’.ite  from  the  proximal  tr.insverse  crease,  as  shown  by  the 
vlashed  line.  It  is  also  common  for  the  pi’oximal  and  distal  transverse 
creases  to  be  joinec  by  a In’idging  crease,  also  shown  in  dashed  lines. 

In  addition  to  the  palmar  and  cai’pale  locations,  creases  exist  at  the 
phalangal  joints  (designated  0,  ;,  ...,  5),  and  facilitate  the  folding  of 
the  skin  as.  required  by  natural  bending  of  the  fingers.  Those  creases 
ar  fairlv  distinct  .ind  seem  always  to  be  there.  They  vary  in  number  and 
T”  ! characteristics,  but  may  prove  useful,  for  example,  in  measuring 
II  lengths. 


^h-iro  12]  described  the  shapes  of  hands,  the  characteristics  of 
id  I r e,.(.rr.<.s  and  unusual  marks  on  the  palm.  Of  course,  his  use  of  these 
features  was  different , and  pei’haps  more  entertaining,  but  their  descrip- 
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tion  provides  a useful  basis  for  the  r;et  of  featui'os  r.hown  in  rij’.vire 
I D-2b. 

i 

! 

The  outline  of  the  hand  ean  provide  several  p.ross  statistics  which  in 

, conjunction  with  other  measurements  may  be  useful  for  personnel  verification. 

r 

I Identimation  Corporation  st'lls  a commercial  product  for  this  [lurpose  based 

simply  on  finp.er  lenp.ths  alone.  There  are  enoup.h  fingers  on  one  hand  that 

I 

' are  sufficiently  uncorrelated  in  length  to  provide  verification  at  slightly 

above  the  d<\sireii  first  level  error  goals  of  the  Base  and  Installation 
Security  System  (BISS)  [ lb],  as  tested  in  I'ecent  experiments  [ 17).  If 

r 

addit  ional  measurements  wt're  mad(',  e.g.  finger  thickness,  palm  width,  thumb 
length/curvature,  wrist  width,  etc.,  a convenient  and  workable  system  may 
! result,  using  only  these  features.  Balm  width,  for  examf'le,  could  be 

measured  from  X to  X'  (see  figure  n-?b)  which  are  the  intersections  of  the 
I two  major  t ransvet'.-.e  crciises  (extended  if  necessary ) iind  th(’  proximal  and 

* distal  edgi's.  of  the  palm,  as.  ■■hown  in  the  outline.  Simple  shadograph  tech- 

nology might  svittice  to  obt.iin  these'  edge's.  fven  if  the  e't'i'ases  were'  not 
ir'.ed,  a minimum  wblth  alg/^rithm  couKi  be'  usi'ei  to  obt  lin  i tinieiue  .ind  ce'en- 
siLitent  metiasure"  of  palm  width.  fing.e’r’  le'ngtl.  ; ,!!■•'  not  ti<'cess.tr i 1 v e-eirre- 

J 

' l.ited  with  p.ilm  width.  Al'to  tinge'r  length:;  .ml  wieith-;  may  b"  ‘utf  i'  i'Sit  I v 

L un-'ort  ■ I i it", I s.. ' r;  te)  pievide?  .idelitional  itnipi'n”  . fV'Si  tine'";  width'  at 

i 

k 

■ I dni  . ■■■  mp.irt'  wi.iths  mi'.is.ure'el  in  th<’  mid.il.'  ed  .-.i.  h ph.il.ingi'  may 

k 

[ supply  .i. I. iition.il  inf  orm.it  iein. 

( 

The  .'xi  t local  ie'n  anei  cut'v.iture'  tune’tion  of  ci’.'.ise  lin.-s  provide 

a yioteiitial  we'.ilth  of  information  .is  to  the  ileniity  of  an  individu.il. 
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Furthermore,  each  crease  can  be  one  .of  several  types  as  shown  in  Figure  D-2b. 
Such  characteristics  as  solid,  parallel,  flared,  etc.,  add  further  differen- 
tiation power  to  this  approach.  Even  their  ends  can  be  different,  e.g. 
forked  or  tasselled.  Also,  creases  are  marked  with  spots,  islands  and 
squares,  as  illustrated.  Unusual  features,  if  they  exist,  provide  further 
means  for  verification.  Such  items  as  scars  and  geometric  figures,  e.g. 
stars,  crosses  and  arrows,  provide  valuable  information  because  of  their  low 
frequency  of  occurrence. 


Stretch  lines,  for  example,  on  the  fleshy  part  of  the  palm  over  the 
first  meta-  caroalebone  (connected  to  the  thumb)  and  on  the  palmar  side  of 
the  digits  are  different  in  depth,  spatial  frequency  (two  spectra,  one 
for  largely  transverse  and  the  other  for  largely  longitudinal  lines)  and 
extent  of  coverage.  These  lines  are  not  flexion  creases,  but  are  somewhat 
different  from  person  to  person. 


It  is  evident,  then,  that  the  palm  surface  details  and  the  projected 
shape  of  the  hand  contains  a rich  variety  of  features  which,  if  measurable, 
should  provide  a sufficient  set  of  attributes  to  meet  the  first  level  BISS 
specifications,  if  not  more  stringent  requirements. 

The  least  certain  aspect  of  these  atiributes  is  their  measurement.  If 
contact  could  be  made  to  a transparent  material,  then  internal  reflection 
imagery  techniques  could  be  used  flBl  to  produce  an  image  that  could  be 
scanned  with  optoelectronic  transducers.  These  have  been  used  to  obtain 
high  quality  footprints  showing  clear  ridge  patterns  ri'ij.  The  difficult 


I 
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aspect  of  the  automatic  feature  measurement,  however,  is  the  alj^or i thms  to 
process  the  electronically  stored  image,  which  is  simply  an  array  of 
reflected  light  intensities,  whose  function  is  to  extract  image  lines, 
measure  their  characteristics  and  quantify  them  for  use  in  verification 
logic.  Such  algorithms  are  not  "off-the-shelf  and  have  to  be  developed 
for  each  application. 


Several  application  routines  already  existing,  for  example,  on  the 
DICIFER  system  at  Rome  Air  Development  Center  [20 J,  such  as  spatial 
differentiation  and  line  following,  may  be  useful  for  this  application. 
However,  as  is  customary  for  nearly  all  unique  pattern  recognition  problems, 
the  set  of  discrinj Inating  features  are  also  unique.  Thus  the  creation  of 
successful  recognition/verification  logic  is  an  experimental  process 
involving  the  iterative  application  of  new  data  and  the  improvement  of  new 


feature  extraction  algorithms  [21). 
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D.2.  HAIR 

Hair  color,  like  height  and  weight,  is  a classical  personal  attribute 
for  identification  and  would  be  a standard  item  in  any  description  of  a 
person.  But,  like  height  and  weight,  it  is  obvious  that  hair  color  can 
only  be  a coarse  discriminator  of  individuals.  We  might  hope  to  find 
ten  or  twenty  different  categories  of  hair  color  once  allowances  are 
made  for  the  day-to-day  variations  which  will  be  introduced  by  such 
factors  as  the  frequency  of  washing,  season  of  the  year  (sun  bleaching), 
or  hair  dyeing.  Anthropologists  use  about  30  hair  samples  for  field 
categorization  [1]. 

The  color  of  an  individual's  hair  could  be  easily  measured  by  placing 
a simple  one-cell  spectrophotometer  in  the  ceiling  of  the  access  booth. 

The  entrance  pupil  of  the  instrument  could  be  focused  on  the  subject's 
head  by  computer  command  once  the  subject's  name  or  code  number  was 
entered  into  the  system.  Oi',  if  the  height  is  also  to  be  a measured 
attribute,  the  focusing  could  proceed  without  reference  to ‘■'‘he  subject's 
known  height.  In  any  case,  the  f-number  of  the  optics  would  be  high 
en 'Ugh  that  focus  would  not  be  critical.  The  spectrophotometer  would 
employ  perhaps  eight  bandpass  filters  on  a rotating  wheel  to  define  the 
'.■■•ti  ii.  : uiJs  ol  interei'.t.  After  passing  the  filter,  the  light  would 
fill  on  a broi.i-band  photomultiplier  tube  such  as  one  of  the  GaAs  types. 
The  filter  wheel,  which  would  bo  in  continuous  rotation,  could  employ  a 
shaft  encoder  to  register  the  filters. 
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If  skin  color  is  also  to  be  measured,  a light  pipe  might  serve  to 
carry  the  signal  from,  say,  the  hand  to  the  same  spectrophotometer.  In 
this  case,  shutters  would  be  necessary  to  select  the  two  signals,  either 
hand  or  hair. 

We  now  wish  to  discuss  the  possibility  of  making  a closer  examination 
of  an  individual's  hair.  Techniques  do  exist  for  examining  the  elemental 
composition  of  a single  strand  of  hair.  The  hair  can  be  distinguished 
as  animal  or  human  [2],  and,  if  human,  whether  of  Caucasian,  Mongolian, 
or  Negro  origin.  However,  "hairs  do  not  possess  sufficient  individual 
characteristics  to  be  identified  as  originating  from  a particular  person 
to  the  exclusion  of  all  others"  [11.  In  addition,  we  have  not  been  able 
to  Identify  any  technological  means  for  the  single  hair  analysis  which 
would  permit  an  identification  system  based  on  it  to  be  cost  competitive 
with  other  techniques. 
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D.3. 


VENOUS  PATTERNS 


D.3.1.  Introduction 


The  lineal  pattern  formed  by  the  superficial  veins  of  the  body  may 
provide  a unique  characteristic  by  which  a person  may  be  identified.  Only 
the  superficial  venous  pattern  of  the  back  of  the  hand  will  be  considered 
in  this  discussion.  There  are  three  reasons  for  choosing  the  pattern 
provided  by  the  back  of  the  hand  over  any  other  venous  pattern.  One, 
the  back  of  the  hand  provides  one  c:  the,  if  not  the  most,  prominent 
venous  patterns  in  the  body.  It  is  so  prominent  that  it  is  usually 
plainly  visible  to  the  naked  eye.  Two,  the  hand  is  the  most  accessible 
part  of  the  body,  requiring  no  removal  of  clothing  and  is  easily  positioned 
for  access  for  the  sensor  system.  Three,  the  hand  pattern  is  complex 
(rich  in  distinguishing  features)  compared  to  other  venous  patterns  of  the 
body,  while  being  contained  in  a small  area  for  easier  processing. 

D.3.2.  Feature  Extraction 

D.3.2.1.  General 

Several  different  methods  are  available  for  the  detection  of  the 
venous  pattern.  Photography  of  the  pattern  in  either  the  visible  or 
actinic  (near  infrared;  700-900  nm)  band,  or  a thermographic  record  via 
liquid  crystals  or  thermographic  scanner  are  two  potential  means  of 
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t'ecordin?,  the  venous  pattern.  After  recorciinfi  the  pattern,  some  method 
must  he  developed  to  take  the  image  data  and  extract  a recognizable  and 
individually  unique  set  of  characteristics  from  the  lineal  features  of 
: he  venous  pattern.  Since  tiiis  is  a problem  common  to  many  of  the 
purposed  attributes,  such  as  palm  prints,  ear  patterns,  bite  patterns, 
etc.,  a separate  analysis  of  it  will  not  be  done  here. 

D.3.2.2.  Thermographic  Pattern  Pxtriction 

One  means  of  extracting  the  venous  pattern  is  by  detecting  the 
temperature  difference  between  the  skin  overlying  : he  superficial  vein 
and  the  surrounding  skin  tissue.  The  skin  overlying  a superficial  vein 
will  normally  be  slightly  warmer  than  the  surrounding  skin,  reflecting  the 
higher  temperature  of  the  venous  blood.  This  temperature  difference  will 
be  more  pronounced  in  the  extremities  where  skin  temperature  variation  is 
the  highest. 

Liquid  crystals  offej’  one  means  of  detecting  the  small  temperature 
ditferences  associated  with  the  venous  pattern.  The  liquid  crystals  indi- 
cate iitferent  t'-mperatures  by  taking  on  different  colors.  By  applying 
1 i raid  u vstilr^*  ’he  •'•kin,  a color  coded  temperature  map  is  produced. 

■ hi.-’  c ■ ; --n  ; ' ecorded  bv  color’  photogr-aphy . One  drawback  to  this 

method  is  that  cont  jct  with  the  hand  is  required,  although  by  encapsulating 
t tie  liquid  cr./stal  in  a itiin  plastic  sheet,  no  direct  contact  of  the 
iiquii  cry^^al  wi*h  the  si  in  is  needed. 
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Another  method  of  producing  a thermographic  map  of  the  skin  is  to 
recoi'd  the  thermal  infrared  radiation  emitted  by  the  skin.  This  blackbody 
radiation  peaks  for  body  temperature  (310°K)  at  about  10  microns.  There 
are  many  thermographic  scanning  systems  available  for  this  purpose. 
Currently  available  systems  have  high  scan  rates  (16  frames/sec),  high 
resolution  (140  x 130  pixels  over  a 11  x 11  cm  area),  and  high  sensitivity 
(T  = 0.1°C). 

Such  thermographic  systems  are  inherently  quantized  in  space  so  that 
direct  interfacing  with  a digital  computer  is  possible. 

One  problem  with  the  thermographic  technique  lies  in  temperature 
variation,  both  the  overall  temperature  variation  of  the  hand  and  the 
variation  of  the  temperature  difference  between  "venous"  skin  and  "normal” 
skin. 


D.3.2.3.  Photography  Pattern  Extraction 

Normal  (visible  light)  photography  would  not  ordinarily  be  sufficient 
to  define  the  vein  pattern.  However,  photography  in  the  actinic  band 
( near- infrared ; 700-000  nm)  is  an  excellent  method.  Superficial  veins 
tend  to  be  very  visible  with  this  type  of  photography,  recording  darker 
than  the  rest  of  the  body.  The  skin  and  superficial  tissues  reflect  most 
of  the  infrared  radiation  falling  on,  and  penetrating  a short  distance 
into,  the  body;  whereas  the  blood  in  the  veins  absorbs  much  of  the 
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infrared.  This  provides  tone  separation.  This  rvpe  of  photopraphy  does 
not  require  a special  camera,  but  rather  only  the  use  of  the  proper 
filters  .iiid  film. 

The  distinctness  of  the  venous  pattern  depends  on  the  thickness  of 
the  overlaying  skin,  the  degree  of  venous  engorgement,  the  condition  of 
the  vein  walls,  and  the  nearness  of  the  veins  to  the  surface.  Conditions 
which  obscure  the  venous  pattern  include  the  following:  a relatively 
thick  layer  of  subcutaneous  fat,  the  thickened  walls  of  varicose  veins, 
and  the  depth  of  certain  large  veins.  The  only  condition  which  might 
obliterate  the  piattern  on  the  back  of  the  hand  would  be  the  large  fat 
deposits  of  an  obese  person. 

P.3.3.  Attribute  Evaluation 


The  evaluation  will  be  broken  into  the  six  categories  listed  in 
Section  2.2. 

D.3.3.1.  Separability 

Separability  depends  on  two  factors:  the  constancy  of  the  character- 
istic atid  the  individual  uniqueness  of  the  characteristic  among  the  popu- 
lation. The  constancy  of  the  venous  pattern  will  be  high,  as  there  is  no 
I ■ : I V mechrinism  to  cause  the  pattern  to  change.  The  main  cause  of 
■hange  in  the  pattern  would  probably  be  due  to  error  in  the  detection 
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system,  and  this  should  be  sufliciently  small.  Inlor-mation  regarding 
unicnieness  ol  the  pattern  is  not  known  to  the  author.  We  have  been 
unable  to  locate  a data  bafu>  ot  vrin  pattet'ris  tor  ttie  tiand,  nor  any 
■'.tatement  to  the  effect  ttiat  the  veii\  pattern  on  the  back  of  the  tiand  is 
uniipie  for  an  individual.  liowever,  from  pi'csonal  oliservation  of  tlie 
pattern  on  other  people,  each  pattern  has  appi'ared  distinctly  unique.  It 
tias  been  ohr.erved  in  medical  studies  that  it  is  tlifficult  to  specify  a 
"noi'mal"  venous  pattern.  This  has  been  especially  noted  in  tlie  existence 
ot  a wide  varietv  ot  venous  pat  ti'rns  from  tlie  female  breast.  We  would 
rate  separability  .it  tlO  i 20  due  to  the  l.iek  of  .a  data  bast'  ft'om  which 
to  iu.ip.e. 


Ibd.d..'".  Acc  ept  (t>i  I itv 


Oliserva  t i . 'u  ftio  ti  in!  via  a ii'n-e.inta  t im.ir.ing  system  sliould  not 
t-e  unac'cept  .ltd  e t-  i.-  ; a i.-.s  t-  a '.ecure  .ire.i.  We  would  rate 

acci'pt  at'  i 1 i t V it  . 


I'. A.  <.A.  T.-ctm.  !.■.•i.  it  d- . i:  i . i-  , 

Botli  tin  rm",-r  aptiii  si  ■ iiin. 'rs  iliil  actinic  pliot . 'gr.ipliv  are  well 
es.t  .lb  I istu'd  ".'1  t - 1 tie- slie  1 1 " .levi.'e,.  Ttie  d i g i t i T.a  t i Oil  .Hid  feature 
'.xtraction  ; rom  ttie  im.u'rv  is-  ids.kier.  We  would  r.ite  tectinologic.il 
t < 1'.  itii  1 i t V lit  t'O  . 
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n.3.3.4.  Cost 


I 


1 


I 

! 


i 


1 

i 


OiHMMt ional  cost  or  purchase  cost  of  eithei'  a thermographic  or  actinic 
photograptiic  system  would  be  acceptable.  Development  costs  for  data  col- 
lection via  actinic  photography  are  acceptable.  F'or  a tliermographic 
-scanner,  .irrangements  would  need  to  be  made  foi'  .iccess  to  a medical  units 
device,  in  order  to  keep  the  cost  lor  data  coll.'Ction  reasonable.  Even 
without  .1  thermographic  scanner,  tlu'rmographic  data  could  be  collected 
with  the  use  of  liquid  crystals.  We  would  rate  cost  at  95. 


D . 3 . 3 . 5 . Speed 


The  image  processing 
con-'umming,  perhaps  10  to 


which  mi  gilt 
15  seconds. 


be  recjuired  could  be  quite  time 
Tlierefoi'e,  we  would  rate  spee<i 


at  80. 


P.3. 3.0.  Penetrabil itv 

An  informed  intruder  with  a preprep-ired  infrared  pattern  could  defeat 
the  rvstem.  However,  the  co.st  of  construct  itig  a fake  pattern  is  liigh,  and 
i.'  highei’  th.in  for  a similai'  optical  system.  We  would  r.ite  penetrability 
at  80. 

. . 4 . Con>  1 us i ons 

We  would  recommend  serious  consideration  of  this  attribute.  Most  of 


I 
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the  ratings  for  this  attribute  are  very  high.  Since  the  hand  is  being 
considered  for  so  many  attributes,  it  would  be  easy  to  combine  this 
attribute  with  other  attributes  of  the  hand.  The  main  concerns  are  two 
(1)  that  the  patterns  be  individually  unique  and,  (2)  that  the  patterns 
be  detectable  for  all  normal  physiological  conditions. 
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D.U. 


PHOTdi’LlvrUYSMDGRAPtiY 


PP.'itoplothv?^nio>’r'ipf'V  is  the  recoi'dinp,  of  t!i<-  volume  of  tiloocl  poeuent 
in  an  exlnemitv,  -^uch  as  the  t inj’oi’  oj’  eai’lol'n-,  by  moasui  iiu’,  th>  t ime- 
vai'vinr.  neflectance  or  transmission  of  lip,ht  at  thi?  extremity.  It  ir.  a 
common  experience  to  ob;;erve  that  one's  h<ind  will  p,low  with  a blood-red 
color  when  illuminated  by  a flashlip.lit  in  direct  contact  with  the  skin, 
providing  that  the  r'oom  is  dark  enoup.h  to  observe  the  effect.  The  I'e- 
tlective  photoplethysmop.r'aph  employs  this  phenomenon.  The  finper  or 
earlobe  foi'ms  a reflective  bridpe  lx.'tween  a 1 ipht  source  and  a 1 ipht 
detectoi'.  These  would  ordinarily  In  (iiodes  in  the  modern  instrument.  As 
the  heart  beats,  a pressure  wave  travels  throupii  the  vascular  system. 

The  pressure  wave  produces  a time-varvinp  amount  of  blood  in  the  extremity 
ml,  in  con  a'quence , the  amount  of  lipiit  reflected  to  t lie  iletector  is  also 
a runction  of  time.  Recordinp  the  output  of  the  detector  pivv.s  a 
history  of  tf'.e  t re^■ -.ure  puls>'.  Gueb.  a record  is  referred  to  as  a 
photopietf'.vrmopram  ( . 

Tfte  PPG  is  kn  'wn  to  vary  in  afiape  and  amplitude  with  chanpe  in  blood 
prx'asur.  , and  henc>-  the  sfi<i!  e of  t lie  wav<.'form  will  not  serve  a'  a stable 
’nYIviduil  ;".itu!''.  [t  can  !'e  ot'Srrved  to  undergo  cfianpes  with  emotion, 
driig'  , and  •■'xt-rci  ■■■,  for  example.  We  propose,  howevei',  that  tfie  t ime  of 
■ 1 1 ef  t!  : ul  e maxima  it  fiducial  points  on  the  hodv,  migfit  bt'ar  a 
m-c  int  ratio  :■  I mien  te  on'-  another.  Suppose,  for  example,  that  the 
I.' lectrf)card  iopram  (!'■)  .ign.il  is  recorded  to  serve  as  a t'eferenre  sipn.il. 


! 

I 

( 


The  PPG  is  measured  at  the  index  fingers  of  both  hands  and  both  earlobes. 
The  delay  between  the  ECG  maxima  and  PPG  maxima  could  then  be  derived 
through  standard  correlation  methods.  One  would  thus  have  avaiJable  four 
time  lags.  These  time  lags  will  depend  on  the  pulse  wave  velocity  which 
will,  in  turn,  depend  upon  heart  rate.  The  heart  rate  could  also  be 
derived  from  the  signals  and  a correction  applied  to  the  four  time  lags. 
This  procedure  would  result  in  four  numbers  which  would  essentially  be 
the  path  length  from  the  heart  to  the  fiducial  points.  Alternatively,  one 
might  form  the  ratios  of  the  four  numbers  to  obtain  three  independent 
numbers  which  would  now  be  proportional  to  the  ratios  of  the  four  lengths. 

In  Figure  D-3  we  show  a typical  photoplet'iysmogram.  Judging  from  the 
sharp  maximum,  we  might  hope  to  achieve  a time  lag  accuracy  of  1/100  of  the 
period  of  the  wave  train.  Taking  the  period  to  be  approximately  1 second 
for  the  normal  heart  beat  and  taking  the  velocity  of  propagation  of  the 
pulse  wave  as  7 m/sec,  we  see  that  a measurement  accuracy  of  7 cm  might 
be  attainable.  This  is  comparable  to  the  resolution  cells  which  we  have 
contempleted  in  the  case  of  height  (2  inches),  and  we  mav  consequently 
conclude  that  PPG  delavs  can  provide  only  a coarse  characterization  of  an 
individual.  The  accuracy  estimate  is  our  best  technical  opinion  based 
on  the  observed  harmonic  content  of  the  PPG  in  Figure  D-3.  It  is  possible 
that  higher  accuracies  might  be  reliably  obtained,  but  it  is  clear  that  an 
accuracy  of  1/1000  of  the  pulse  period  is  called  for  before  the  PPG  delays 
we  have  described  can  serve  bv  themselves  as  useful  individual 
discriminants. 


D-30 


D.5. 


RESISTIVITY  OF  THE  HUMAN  TORSO 


D.5.1. 


Theory  of  Magnetically  Coupled  Inductance 


I 

1 


\ 


] 


The  resistivity  of  a conductive  body  (such  as  a human  body)  can  be 
measured  by  inductive  magnetic  coupling  without  making  physical  contact 
with  the  body.  The  basic  principal  is  as  follows.  A transmitting  coil  is 
energised  with  a sinusoidal  current  which  creates  a time  varying  magnetic 


field  in  its  vicinity.  A second  receiving  coil  is  located  at  a fixed 
distance  from  the  transmitting  coil,  where  it  picks  up  a signal  voltage 
due  to  the  oscillating  magnetic  field  of  transmitting  coil.  When  a con- 
ductive body  is  brought  into  the  vicinity  of  the  transmitting  coils, 
currents  are  induced  in  that  body  which  are  proportional  to  the  conducti- 
vity of  the  body.  These  induced  currents  in  turn  produce  a time  varying 


magnetic  field.  This  magnetic  field  due  to  the  conductive  body  becomes 

a second  source  of  signal  to  the  receiving  coil.  This  signal  voltage 

is  several  orders  of  magnitude  smaller  than  the  signal  from  the  transmitting 

coil,  so  electronic  processing  is  used  to  cancel  the  transmitting  coil 

7 

signal  to  about  one  part  in  10  . One  important  aspect  of  this  type  of 
measurement  is  the  sensitivity  of  the  signal  to  the  distance  of  the  probe 
from  the  conductive  body.  In  one  experiment,  a change  in  distance  from 
the  probe  to  a human  body  from  73.5  to  106.8  mm  produced  a 70%  reduction 
in  signal  voltage.  The  signal  voltage  appears  to  drop  as  the  seventh 
power  of  distance. 
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D.5.2. 


Technical  Setup 


The  type  of  physical  setup  for  access  control  using  this  type  of 
atti'ibute  would  involve  some  technical  advances  over  present  equipment 
design.  Since  it  is  doubtful  that  each  individual  has  a unique  body 
resistivity,  one  would  need  several  probes,  measuring  resistivities  at 
different  points  on  the  body,  to  form  a pattern  of  body  resistivities. 

This  pattern  of  resistivities  may  then  be  unique  to  the  individual. 
However,  some  means  of  measuring  and  correcting  for  changes  in  probe-to- 
bodv  distances  would  be  needed  in  order  to  match  measurements  taken  at 
different  times.  Some  means  would  also  need  to  be  developed  to  auto- 
matically correct  for  metal  objects  on  a person's  attire.  Such  objects 
would  include  metal  buttons,  jewelry,  pens,  glasses,  belt  buckles, 
change  in  a pocket,  watches,  etc.  Obviously,  removal  of  all  such 
objects  would  prove  unacceptable.  However,  the  phase  of  the  signal 
voltage  due  to  metallic  objects  differs  from  that  of  the  non-metal  lie 
body.  Additionally,  of  more  than  one  probe  were  used  simultaneously,  some 
means  to  prevent  cross-talk  between  the  probes  would  be  needed. 

D.5.3.  Attribute  Evaluation 

D.h.3.;.  .Separability 

Since  the  resistivity  of  the  body  depends  on  the  basic  salinity  of 
the  body  ti'  ues , changes  in  the  salinity  will  change  the  resistivity 
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attribute.  Changes  due  to  the  imprecision  of  the  measurement  equipment 
could  be  very  significant.  The  uniqueness  of  any  one,  or  any  pattern  of, 
resistivity  measurements  is  simply  not  knovm.  No  data  base  of  such 
measurements  exist.  Since  people  are  all  grossly  the  same  type  of  saline 
bag  of  water,  we  would  not  imagine  that  large  differences  in  resistivities 
exist.  We  would  rate  separability  at  60  ^35. 

D.5.3.2.  Acceptability 

If  technological  improvements  cannot  solve  the  problems  involved 
with  metallic  objects  and  allowance  for  probe  to  body  distance  variations, 
then  the  system  would  be  unacceptable.  If  such  problems  are  solved,  we 
would  rate  this  at  70.  The  fact  that  it  is  radiatively  intrusive  to  the 
body,  even  though  very  small  currents  are  involved,  makes  it  less  than 
100%  acceptable. 

D.5.3.3.  Technological  feasibility 

The  method  of  magnetically  coupled  resistive  measurements  is 
technically  feasible.  The  improvements  required  for  an  acceptable  system 
are  the  areas  where  technical  feasibility  is  more  questionable.  Although, 
improvements  to  correct  for  metallic  objects  (through  phase  information)  and 
for  probe  to  body  distance  variation.s  are  theoretically  possible,  the 
technological  implementation  would  prove  difficult.  We  would  rate  techno- 
logical feasibility  at  40. 
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n.5.3.4.  Cost 


Through  a conversation  with  Dr.  Dichai'd  McTee  of  Syracuse  University, 
ihe  co-developer  of  the  magnet  ical  ly-courl '■!  resistive  method,  ti.e  author 
concludes  that  no  commei'cial  an't  ; exist;  .ilso  that  no  imiirovements  have 
been  made  on  the  basic  techniqir  . Access  to  the  unit  Dr.  McFee  built  did 
not  seem  possible.  Fie  was  interested  in  perFiaps  building,  a simplified 
version  of  the  unit.  Considering  the  lack  of  access  to  equipment  and  the 
improvements  needed  to  the  basic  technique,  we  would  rate  cost  at  10. 

D.  5 . 3 . 5 . Speed 

Speed  of  operation  would  be  no  problem.  Vie  would  rate  speed  at  95. 

D.5.3.t'.  Penetrability 

It  w.'uld  be  difficult  to  mimic  the  resistivities  to  an  accurate 
enoug,h  degree,  so  that  we  would  rate  penetrabilities  at  40. 

: . .4.  Cone! us  ions 

Wf  would  recommend  against  pursuing  this  attribute  any  further.  The 
t-t<-:':-  I'  ••Mr, ihility  problem  along,  witF  the  uncertainty  of  its 
'-.••pam'  -litv  make  tFiis  approach  unfeasible. 
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D.6. 


TREMOR  RECOGNITION 


Muscular  tremors  have  been  placed  in  three  categories  by  Wyatt  [1]: 
"at  rest",  "intention",  and  "static". 

Intentional  tremors,  those  which  occur  while  the  muscles  are  under 
deliberate  stress,  do  not  manifest  themselves  as  measurable  motion  and  so 
are  not  considered  likely  for  attribute  verification.  Similarly,  the 
member  is  supported  in  the  "rest"  tremor  situation  thus  masking  tremors. 
Tremors  become  easily  visible  and  measurable  in  the  "static"  form  when  the 
member  is  at  rest  but  unsupported. 

Data  collection  initially  should  consist  of  digitized  output  from  a 
photocell  which  the  test  subject  attempts  to  illuminate  with  a small  light 
source . 

A number  of  configurations  have  been  suggested  for  the  actual  access 
room  to  utilize  this  measure.  Several  different  motion  sensing  methods 
are  available. 

The  pattern  to  be  matched  will  be  a modification  of  the  raw  motion 
data,  possibly  a power  spectrum  or  other  distillation. 

Preliminary  evaluation: 

1.  Separability  - unknown  until  data  becomes  available.  Wyatt 
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shows  that  finger  tremors  are  sufficiently  rich  and  repeatable 
to  separate  some  individuals.  Rating  40. 

Acceptability  - should  be  quite  high  since  the  method  is  simiile, 
quick,  painless,  and  non- invasive . Rating  85. 

Equipment  - rates  90,  should  be  simple  to  build  or  modify. 

Cost  - simplicity  of  method  and  equipment  gives  this  a high 
rating.  Rating  90. 

Speed  - sample  times  in  Wyatt  varied  from  about  3 sec  to  over 
12  sec.  It  is  not  clear  how  long  will  be  required  for  arm 
tremors  so  speed  is  rated  75  for  a 10-second  sample  and  additional 
time  for  analysis. 

Penetrability  - It  is  difficult  to  imagine  an  agent  being  trained 
to  simulate  involuntary  tremors.  The  photocell  could  be  fooled  by 
a light  controlled  by  a recording  of  the  proper  person's  tremors. 
The  coil  moving  in  magnetic  field  sensor  would  be  much  harder  to 
■'imulate  yet  no  more  difficult  to  use.  Rating  80. 
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D.7.  DYNAMIC  RESPONSE  OE  THE  HEAD 


It  has  been  proposed  that  the  response  of  the  head  to  mechanical 
vibration  be  used  as  a means  of  personal  identity  verification.  Broad- 
band or  narrow-band  excitation  of  the  skull  could  be  conveniently  accom- 
plisned  using  a piezoelectric  transducer  driven  by  an  electronic  wave 
generator,  fot'  example.  The  dynamic  response  to  such  excitation  could 
then  be  measured  by  means  of  an  accelerometer  coupled  to  a second  contact 
point  on  the  head  (or  between  the  teeth  [1]).  Spectrum  analysis  might 
be  employed  to  identify  resonant  frequencies  of  the  skull,  jaws,  teeth, 
etc. , and  hence  establish  features  for  differentiating  between  individuals. 

The  concept  of  ID  verification  using  the  dynamic  response  of  the 
human  body  has  been  patented  by  Ott  [2].  A survey  of  the  patent  and  other 
aspects  of  biodvnamics  is  contained  in  Section  2.23.  Key  body  resonances 
are  known  to  exist  in  the  4-8  Hz  range  [3,4].  Studies  have  suggested 
that  above  15  Hz  the  dynamic  response  of  the  body  is  highly  characteristic 
of  the  individual  13,4].  Heavy  damning,  of  the  incident  energy  is  also 
known  to  occur  above  100  Hz. 

Tlio  technology  needed  to  implement  an  ID  verification  system  based  on 
bi;)-dvnamics  appears  available.  In  fact,  the  transducer  instrumentation 
coulci  be  assembled  using  "off-the-shelf"  components  at  a cost  of  a few 
.lunilred  doll  irs.  A microprocessor  might  also  be  used  to  process  eacii 


respon.a'  icnal  anl  compare  it  with  a sample  obtained  from  a magnetically 


encoded  cai’d.  Ac’cordi.it',  1 v,  tho  t»'chiu'U)>’,  ic.il  t o.  ^ ib  i 1 i t y of  this  method 
I'ates  a sc'oi'o  ot  100.  Pi'i’t.'ct  ?;coi’.'  it'o  al.so  associatt'd  with  separability 
and  opei'at  ine.  speed. 

However,  it  woulii  be  fair  to  !:av  that  regular  uaer.j  of  such  a system 
mip.ht  be  appreheiu;  i ve  about  repeatedly  havinp,  their  "heads  examined". 
Moreover,  ^;oIlle  dir.oomfort  ci'uld  be  anticipated  dur'inp,  screcninp,  in  view 
of  the  neeeisitv  tor  I'er.onanet's  ot  the  hi’ad  to  Ih'  excited.  It  is  known, 
tor  inr.tance,  that  .it  10  Hr,  the  face  and  cheeks  tend  to  flutter  if  the 
exeit.it  ion  i,  sti'onv’,  enotu’h  1 *' I . Simil.irlv,  dent.il  discomfort  might  be 
oh  jee  t ion.ibl  e , p.ii'ti.  .l.trlv  for  wearers  of  loose  dentures.  Also,  tempor- 
irilv  bluT't'ed  vision  .irir.inp,  from  the  inability  ot  the  eye  to  follow  the 
motion  ot  .1  ref  in.il  im.iee  in  the  3-00  Hr  r.inge  [ .1  ] might  be  ,i  complaint, 
unle  s u er  ; were  told  to  shut  their  eve;;  during  r.creeninr. 

Hsei’  .icc*-pi  if- i 1 i t v w-uld  prob.ibly  incriMs.e  if  t tie  vibrating  .source 
not  .ou;  b'.i  dir-'otly  t.>  t fie  head.  As  a 1 1 ern.if  i v.'s , mechanic. il  energy 
.■.■>u;  ! introdu-.-d  to  the  feet  or-  se.it  ot  ,i  standing  or  sitting  subiect. 

i'hen  t t'.e  .u'e>- 1 i-i-om. -t  er  u to  me.isure  ttn-  respons.e  of  t ht'  h(\id  would  in 

ct  t’.  et  Hi.  I ur'e  tl..  ri':.p-'>nr.e  of  t l,e  cut  i I'o  body,  and  ttiori'fore  be  c.ip.ibU' 

• b 1 1 ini’  th‘  ''iiori’.v  t ran.  ;m  i 1 1 <>ii  t firougfi  it.  This  .ippro.ich  would  .il.so 
.il  d'le  f 'T'  I!  vei  i'ie.ition.  nut  body  rer.ponse  measurements  would  be 
al.’hly  ".en".  i t i to  po'O  ure  an.i  eomposure  [ll,  so  tfi.it  the  error  rates  could 
-xt'Cted  to  ri'."  iceor  1 i ng  1 . 
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In  conclusion,  the  biodynaniics  of  the  head  at  first  glance  appears 
to  offer  an  attractive  basis  for  establishing  a new  ID  verification  system. 
However,  such  a system  would  most  likely  incur  considerable  user  resistance 
stemming  from  both  physiological  and  psychological  effects,  although 
tt'st Ing  at  low  vibration  levels  might  prove  otherwise.  In  any  case,  a 
patent  license  would  be  requii'ed  for  implementing  any  of  the  conceiits 
described  here. 
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D.8. 


TEETH 


rifteen  teeth  characteristics  have  been  observed  by  Dr.  Oscar  Amoedo 
in  1898  [ll.  They  can  be  classified  by  the  following: 

A.  Related  to  individual  tooth: 

o Dimension  of  the  tooth 

o [’orm  of  the  tooth 

o Color  of  the  tooth 

o Fillings 

o Unfilled  cavities 

o Diseased  tooth 

o Abnormal  forms  of  the  teeth 

B.  Related  to  the  teeth  arrangements: 

o Absence  of  teeth 

o Irregularity  of  teeth  with  their  positions 

o Curve  of  the  dental  arcade 

o Width  of  the  arc 

o Height  of  the  vault 

C.  Miscellaneous: 

o Color  and  texture  of  the  gum 


I 


I 


j 


I 
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o 

Artificial 

dental  crowns 

o 

Artificial 

teeth 

Platschick,  usin?,  a set  of  nine  measurements  on  the  teeth,  observed 
that  although  these  measui'ements  were  taken  from  skulls  of  the  same 
race,  one  had  never  been  able  to  find  three  identical  measurements  on 
two  subiects,  rarely  two,  and  even  one  only  with  difficulty. 

The  teeth  features  extractable  from  a bite  pattern  are  limited  to 
those  related  to  the  teeth  size,  shape,  rotation,  and  displacement.  The 
bite  pattern  will  be  changed  due  to  the  force  applied,  the  duration  of 
the  application,  the  degree  of  the  movement  between  tissue  and  teeth 
during  the  application  of  the  force  [2],  the  suction  and  tongue  thrusting 
force  [3j,  and  the  material  properties  of  the  tissue. 

The  statistics  extracted  from  models  of  6 upper  anteriors  were 
studied  by  MacFarlane,  et  al  at  Glasgow  Dental  Hospital  and  School  in 
1974.  [4]  Two  hundred  samples  over  age  16  were  randomly  taken  at  the 
dental  hospitals  in  the  Glasgow  area.  The  result  shows  that  at  95% 
confidence  level,  60.4%  of  the  population  aged  16  and  above  have  six 
normal  upper  anteriors,  7.4%  have  six  upper  incisor  posteriorly  displaced, 
21.6%  have  the  upper  left  lateral  incisor  slightly  mesio-labial  rotated. 
Considering  all  these  phenomena  statistically  independent,  8 in  100,000 
of  the  population  with  some  natural  teeth  might  be  expected  to  have  a 
similar  dentition. 
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Technical  considerations  rapidly  reduces  the  prospective  usage  of 
hite  pattern  as  entry  control.  First  of  all,  the  sensoring  and  recording 
problem.  Direct  sensoring  equipment  similar  to  the  one  used  to  measure 
the  suction  force  [3]  are  beyond  imagination.  Indirect  sensoring 
approaches  which  take  the  image  of  the  bite  pattern  with  other  transducers 
such  as  a TV  camera  seem  to  be  the  only  solution  at  the  present  time. 

The  subject’s  acceptability  to  such  an  approach  will  not  be  high  due  to 
t'isk  of  infection.  Secondly,  the  reliability  of  the  measurements  may  be 
low.  As  previously  mentioned,  the  force  applied  to  the  tissue,  the 
duration  of  applying  the  force,  etc.,  will  change  the  pattern  obtained 
for  identification.  To  remove  the  deviations,  or  to  incorporate  these 
deviations,  requires  further  study. 
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D.9. 


THE  EAR 


The  ear,  thanks  to  the  many  hills  and  valleys  which 
cross  it,  is  the  most  important  factor  for  identifi- 
cation of  the  human  face.  Actually,  it  is  almost 
impossible  to  come  across  two  eai''s  which  are  identi- 
cal in  all  their  parts,  and  some  of  the  variations 
in  form  which  that  organ  presents  appear  to  continue 
without  modification  from  birth  to  death. 

- A.  Bertillon,  1893  - 

The  outer  ear  (herein  referred  to  simply  as  the  ear)  of  a human  being 
consists  of  several  visually  discernable  parts:  the  helix,  the  antihelix, 
the  tragus,  the  antitragus,  the  lobe,  the  concha,  etc.  (Figure  D-4).  Verbal 
description  of  the  size,  shape,  color,  texture,  peculiarities,  locatiin 
of  the  ear  and/or  the  pai'ts  has  been  used  for  personal  identification.  The 
variety  and  richness  of  these  features  indicates  that  entry  control  based  on 
the  subject's  ear  structure  is  promising  ^ these  verbal  descriptions  can 
be  translated  into  mechanically  measurable  properties,  if  these  measurements 
can  be  obtained  quickly  and  accurately,  and  i_f  those  features  remain 
unchanged  for  a reasonable  time  duration. 

Relevant  research  in  digital  image  processing  and  pattern  recognition 
vi-’ld'.  the  following  results  on  an  isolated  object: 

o Obiect  size  is  linearly  proportional  to  the  number  of  picture 
eb'-.^nts  within  the  object  boundary. 
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ABODE:  Outer  border  of  the  Helix 

A:  Point  of  origin 

AB:  Origination  part 

BC : Superior  part 

CD:  Posterior  part 

DE:  Inferior  part 

HIJKL:  Inter  bordei'  of  the  Helix 

EFG:  Outer  border  of  the  lobe 

NOP:  Border  of  ihe  tragus 

QRS:  Border  of  the  antitragus 

VUTS:  Border  of  the  antihelix 

GG' : Adherence 

Area  within  MNOPQRSTUV : concha 
Area  above  VUT  and  below  UK:  fossa  innominata 
Area  between  QRS  and  EFG:  the  lobe 


Figure  D-4  The  Outer  Ear  (Continued) 
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Object  shape  can  be  presented  separately  as  topological  properties 
such  as  the  connectivity,  the  genus  and  metric  properties  such 
as  the  curvatures  and  positions  of  points  of  extrema  along  the 
object  boundary. 

o Object  color  can  be  measured  as  grey  shades  sensed  in  different 
spectral  bands. 

o Object  texture  can  be  described  as  statistical  mensurations 
such  as  the  mean,  variance,  skewness,  etc.,  of  the  image 
spacial  distribution. 

o Object  location  can  be  measured  as  the  distances  between  the 
object  and  two  reference  points. 

The  mensuration  time  depends  on  the  speed  in  data  acquisition  and  pro- 
cessing. Excluding  the  human  operation  time,  the  former  depends  on  the 
equipment  used.  The  Computer  Eye  of  Spatial  Data  System,  Inc.,  for  example, 
requires  34  seconds  to  digitize  a 480  by  512  image  and  store  it  on  the  mag- 
tape but  only  2.1  seconds  if  sufficient  RAM  is  available  [2].  The  data 
processing  time  depends  on  the  amount  of  data  acquired,  type  of  measurement 
used,  precision  requirement,  algorithm  adopted  and  hardware  support.  The 
mensuration  accuracy  depends  on  sensor  resolution,  data  representation 
precision,  algorithm  used,  etc.,  and  is  biased  by  the  ambient  condition  and 
operation  procedure  during  data  acquisition  and  processing. 
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For  oach  individual,  tho  leaturns  cited  above  are  different  betweeii 
the  two  ears,  and  vary  according  to  hir.  age,  weight,  height,  p'hysical  and 
mental  condition.'..  Color  of  the  eaj-,  for  example,  changes  drastically  when 
the  subject  is  irritatt'tl.  On  the  other  hand,  the  ear  is  less  vulnerable 
compared  with  other  physiological  attributes  such  as  the  hand  and  the  foot. 
According  to  our  preliminary  investigation,  it  seems  reason. able  to  assume 
that  under  normal  conditions,  these  features  remain  const. ant  for  adults 
during  ci  rc.'asonable  period  of  time. 


Meti'ic  fe.atures  extractable  from  the  ear  include  (figure  D- 4) : 


.1.  The  locations  of  tho  points  A to  V 

b.  The  curvatures  at  these  points 

c.  The  distances  between  point-sets  A,H;  B,I;  C,.!;  K,D;  (width  of  the 
Helix) 


d. 


The  .area.s  enclo.sed  bv  f,r,G,Q,R,S  (size  of  the 
'r,I',H,A  (thi'  size  of  the  concha),  by  I,.1,K,U,V 
inir  mlr.  la  il,  V,0,f  (.size  of  the  tragu.s),  Q,R,S 

The  dist  ince.s  between  C,r  (length  of  the  ear), 
ei!’)  .ind  C,"  (the  i.pgr.'.-  of  adherence) 

Th'-  angles  betwf'c-n  lines  BG  and  QS 


lobe),  by  M,N,0,P,Q,R,S, 
(size  of  the  tassa 
(size  of  the  antitragus) 

B,n  (the  breadth  of  the 
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It  should  be  noted  that  some  of  those  points  may  be  unavailable,  such 
as  R.  Some  of  these  measurements  may  be  linearly  dependent  and  additional 
independent  features  can  be  derived  from  these  measurements.  Some  qualita- 
tive ear  descriptions  taken  from  [l]  are  shown  in  Figure  D-5.  Prom  these 
figures,  more  metrics  can  be  derived  if  the  sensor  is  powerful  enough. 

In  the  following  discussion,  the  Computer  Eye  will  be  used  as  the  input 
sensor.  Considerations  will  be  given  centered  on  this  particular  system 
prototype.  Suggested  equipments  are  listed  in  Table  D-2. 

The  size  of  the  human  ear  seldom  exceeds  8.0  cm  in  length  and  5.0  cm 
in  breadth  (Table  D-3).  For  0.5  mm  resolution,  which  is  less  than  one- 
quarter  of  the  error  introduced  by  manual  mensuration  [3J,  the  whole  ear 
image  can  bo  digitized  within  a 100  pixel  long,  100  pixel  wide  matrix.  For 
8 bits/pixel  greylevel  quantization,  it  requires  16  K 8-bit  bytes  to  store 
the  data,  or  about  8 K 16-bit  words. 

The  Computer  Eye  scanner  can  scan  an  image  area  of  480  lines,  512 
pixels  per  line  in  seconu.  It  takes  51.2  us  for  each  horizontal  scan 
plus  12.3  us  for  horizontal  retrace  and  2857.5  us  for  total  vertical  retrace 
1 rame . Under  the  normal  digitization  mode,  the  digital  computer,  under 
: r.  gr.im  control,  issues  the  picture  location  to  be  digitized.  When  the  scan- 
nit. r ',p<-i»  (■••aches  the  location,  the  light  intensity  at  the  location  is  con- 
» > inilog  voltage  signal.  An  additional  5 us  is  required  to  convert 

. i.  >'  -iign.il  to  R-bit  digital  values  - ready  to  transfer  to  the  computer. 
ii  ''('71.2  us/512)  = 50  pixels  .3re  skipped  horizontally  between 


i 


.1  b 

/ I . ' / 


.1  b 


ri.r.ur'"  D-b  Qu  i 1 i t ,it  i vr  E'„ir 


Open  (a),  intcrmodiatt.'  (b)  and 
adherent  (c)  form  of  ttie  postei'- 
ior  tiorder  of  tdie  ear. 


bower  fold  witfi  horizontal 
profile  concave  (a),  intermediate 
(b)  and  convex  (c). 


Rectilinear  (a),  intermediate 
(b)  and  pro-jectirif^  (cl  profiles 
of  antitrapus. 


Anritrapus  with  horizontal  (a), 
intei'mediate  (b)  and  oblique  (cl 
inclination 


Feature  Pescriptions 
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r 


b 


Square  (a),  intermediate  (b)  and 
rounded  (c)  lobes. 


a 


Lobe  with  fused  (a),  intermediate  (b) 
and  separated  (c)  adherence. 


Figure  D-5  Qualitative  Ear  Feature  Descriptions  (cont'd) 
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1.  Computer  Eye 


a.  Scanner 

b.  Display 

c.  Digitizer  Electronics 

2.  DEC  PDP-11  with  H K word  memory 

3.  Tape  Drive  foi’  Data  Bank 

4.  Keyboard/Cursor  (optional) 

5.  Light  Source  (optional) 

6.  Mechanical  Height  Control  for  Scanner,  Light  Source,  etc. 
(optiona  1 ) 


Table  D-2  Suggested  System  Equipment  for 
Ear  Pattern  Extraction 
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Height  (cm) 


Ear  Breadth  (mm ) 


I- 


165 

62 

37 

1 66 

62 

37 

167 

63 

37 

168 

63 

37 

169 

63 

37 

170 

63 

37 

171 

63 

37 

172 

64 

37 

173 

64 

37 

174 

64 

37 

175 

64 

37 

176 

64 

37 

177 

64 

38 

178 

64 

38 

179 

65 

38 

180 

65 

38 

181 

65 

38 

182 

65 

38 

183 

65 

38 

184 

65 

38 

185  65 

50%  of  the  samples  fall  in  between  jt  2 mm  of  the  average 
90%  of  the  samples  fall  in  between  + 5 mm  of  the  average 
98%  of  the  samples  fall  in  between  + 8 mm  of  the  average 


38 


Table  D-3  Average  Ear  Size  vs.  Height  from  165  cm  to  185  cm  Adults  (1893)[ll 
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I'ach  data  transfer.  In  order  to  digiti;;e  a 160  by  100  ear  imape,  the  imap,e 
has  to  be  scanned  50  times.  Thus,  1.67  second  is  rt'quired  if  8 K word  hiph- 
speed  memory  is  available.  (Recommended  spacing  is  64  pixels  skipped. 
Tli.M'efore , 2.1  seconds  is  required  to  record  the  image.) 

Assuming  each  integer  addition  takes  450  ns  and  each  multiplication 
takes  750  ns,  then  it  takes  26.4  ms  to  compute  the  correlation  between  two 
160  X 100  ear  images  X,Y  based  on  the  formula 

160  X 100 

c(X,Y ) = Z (x.  - y.  ) 

i = 1 " ^ 

where  x^,  y^  are  intensities  at  location  i in  the  image  X,  Y,  respectively. 
Considerable  overhead  is  forseeable  for  image  intensity  normalization, 
proper  registration  and  image  fetching  from  peripheral  devices.  Neverthe- 
less, 1 second  will  be  sufficient  to  cover  these  operations. 

If  the  lineal  features  such  as  those  discussed  previously  are  to  be 
extracted,  then  the  obiect  has  to  be  isolated  first.  Typical  procedure  for 
object  isolation  involves  edge  detection,  boundary  tracing  and  encoding, 
irimetCT'  extraction,  etc.  Assuming  the  input  image  is  digitized  under  con- 
trol, then  the  operational  parameter  values  should  be  consistent.  Since  the 
wliole  image  is  stored  in  the  high-speed  memorv , processing  time  should  be 
very  short.  for  instance,  it  takes  65  ms  to  compute  the  gradient. 
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Frulii  the  above  discussion,  the  success  of  personal  identification  based 
on  the  .iubject's  ear  structure  relies  heavily  on  the  image  collection  pro- 
cess. The  ambient  luminance,  any  earring  worn  by  the  subject,  the  color  of 
the  hail’  and  clothes,  all  directly  affect  the  light  intensity  collected  by 
the  sei\sor.  The  relative  angle  between  the  sensor  and  the  ear  surface 
normal  introduces  geometrical  distortion.  The  distance  between  the  ear  and 
the  sensor  and  the  focus  of  the  sensor  should  be  carefully  adjusted  to 
reduce  error.  How  much  distortion  is  tolerable  should  be  studied.  Never- 
theless, proper  registration  is  desirable  at  the  data  acquisition  stage  to 
reduce  the  operational  deviations.  We  propose  a procedure  in  which  the  sub- 
ject under  test  is  required  to  submit  some  passwords  for  preliminary  identi- 
fication and  ear  pattern  registration. 

Figure  D-6  shows  those  system  equipments  visible  to  the  subject.  The 
positions  of  the  TV  camera  and  the  monitor  are  fixed  on  the  stand.  The 
heights  of  the  camera,  monitor  and  light  source  can  be  automatically  adjusted, 
as  can  the  orientations  of  the  TV  camera  and  the  light  source.  A cursor  is 
attached  to  the  keyboard  so  that  the  subject  can  move  the  location  of  a 
rectangular  graph  on  the  TV  monitor.  The  size  of  the  rectangular  graph  is 
entered  through  the  keyboard.  There  are  9 "regions"  within  the  rectangle, 
as  shown  in  Figure  D-7.  The  subject  can  select  any  number  in  any  order  of 
these  regions  to  extract  features.  Obviously,  only  the  correct  person  knows 
the  size  of  the  rectangle,  the  number,  the  region  id's  and  the  order  of  the 
regions.  Additional  information  such  as  the  heights  of  the  camera,  light 
source  and  TV  monitor,  the  orientations  of  the  camera  and  the  light  source 
which  are  only  known  to  the  correct  person,  can  be  entered  through  the 
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Figure  D-6  System  Prototype  For  Ear  Structure  Attribute  Extraction 
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0 
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4 

5 

6 
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9 

Figure  D-7  Nino  Regions  Within  The  Rect <■  . The  TV  Monitor 
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keyboard  to  increase  the  difficulty  of  penetration.  It  is  recommended  that 
the  ranges  of  the  size  of  the  rectangle,  the  heights  and  orientations,  etc., 
be  divided  into  less  than  10  intervals  and  encoded  by  0 through  9 so  t.nat 
the  authorized  personnel  can  memorize  them  with  ease. 

When  the  subject  is  taking  the  test,  he  first  enters  the  size  of  the 
rectangle,  the  number  of  regions  in  the  rectangle,  their  ID  sequence, 
along  with  optional  numbers  such  as  the  heights  and  orientations  of  the  TV 
camera  and  the  light  source,  etc.,  through  the  keyboard  in  question- 
answering fashion  with  the  computer.  These  values  serve  as  the  password  for 
further  test. 

The  successful  subject  then  registers  the  ear  by  viewing  the  TV  moni- 
tor. First,  he  registers  his  head  location  relative  to  the  TV  camera.  Then 
he  focuses  the  TV  camera  lens  until  the  image  of  the  ear  has  similar  sharp- 
ness as  those  he  takes  as  "masks"  originally.  Then  he  moves  the  location 
of  the  rectangle  through  the  cursor  so  that  the  ear  is  properly  registered 
within  the  rectangle.  Finally  he  presses  the  "GO"  button  for  the  computer 
to  scan  the  ear  image,  digitization  and  identification. 

1.  Acceptability : High 

Possible  objections  of  using  the  system  are 

a.  The  subject  might  be  requested  to  pull  back  his  hair  to  show 
the  ear  during  the  registration. 
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b.  The  subject  might  be  requested  to  take  off  any  earrings. 


c.  The  subject  has  to  memorize  the  password  which  is  about  10  digits 


(of  a telephone  number's  length). 


d.  The  subject  might  be  unwilling  to  show  the  ear  for  psychological 


reasons . 


2.  Penetrability:  Low 


Pre-screen  Phase:  The  subject  has  to  enter  the  correct  password, 
which  at  least  consists  of  the  rectangle  size  code,  the  number 
of  regions,  and  the  region  ID-sequence.  Assuming  5 regions  were 
selected,  then  there  are  gP^  = 15120  permutations  for  the  ID- 
sequence.  This  number,  in  addition  to  the  1000  possible  combin- 
ations of  the  rectangle  length,  width  and  the  number  of  regions 

-7 

selected,  reduces  the  Typo  II  error  under  10 


b.  Computer  Ident  i f ica  t io7i  Ph<ise:  technique  dependent. 


.■•,'1  irabilitv:  Insufficient  Data 


*.  Cost: 


j.  Dovlopment  C:.;t:  It  a suitable  image  processing  system  is  avail- 
able for  use,  then  development  cost  in  algorithm  implementation  is 
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negligible  compared  to  data  generation.  For  90  subjects,  3 images/ 
subjects  estimated  processing  time  will  be  2 man-weeks  excluding 
experimental  time  for  proper  procedure  determinations.  The  latter 
will  be  3 man-days,  conservatively. 

b.  Purchase  Cost:  If  Computer  Eye  and  associated  equipments  are 
available,  then  purchase  cost  will  be  negligible  compared  to  the 
development  cost. 

c.  Operating  Cost:  Unknown. 

5 . Speed : 

Should  be  less  than  10  seconds,  including  data  acquisition,  and 
processing. 


6. 


'echnology  Feasibility:  No  Problems  are  anticipated. 
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ELECTROENCEPHALOGRAPHY 


Electrical  signals  produced  by  the  brain  were  discovered  by  Caton  in 
1874.  In  contrast  to  the  rather  simple,  strong  (~  mV)  electrocardiographic 
signal,  the  electroencephalographic  (EEG)  signals  are  complex  and  small  ('^U 
V).  The  voltages  are  usually  recorded  at  eight,  ten,  or  even  twenty  points  on 
the  skull,  each  as  a monopolar  signal  with  the  ear  or  neck  serving  as  ground. 
At  first  glance  the  signals  appear  to  be  simply  band-limited  white  noise  with 
a cutoff  frequency  in  the  neighborhood  of  50-100  Hz.  Actually,  spectral 
analysis  shows  the  presence  of  a dominant  frequency  near  10  Hz  for  most 
individuals. 


Because  the  brain  is  the  seat  of  the  intellect,  it  is  tempting  to  suppose 
that  these  brain  waves  are  intimately  related  to  thought  processes  and  that 
consequently  monitoring  the  EEG  would  distinguish  individuals.  Surely  our 
personalities  are  unique. 


"But  individuality  remains  and  it  is  instructive  to  consider  what  it 
means.  Where  is  my  individuality,  for  example?  If  I consider  this 
question,  it  is  clear  that  individual! ry  does  not  reside  to  any 
great  extent  in  my  limbs  or  internal  organs,  all  or  most  of  which 
can  be  replaced  by  protheses  or  by  transplants,  or  yet  in  my  senses  - 
if  I were  deaf  or  blind  I would  still  be  me  in  some  sense.  But 
suppose  a brain  transplant  were  possible?  Transplant  someone  else's 
brain  into  "my"  body  and  "I"  would  not  be  "me" . "I"  would  now  be 

the  other  person  whose  brain  now  operates  in  "my"  body  - it  would 
make  more  sense  to  talk  about  a body  transplant."  [2] 

"A  case  may  be  made,  therefore,  that  his  memories  are  the  most 
durable  and  vital  characteristic  of  an  individual."  [2] 
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Unfortunately,  the  EEG  signal  is  a coarse  measure  of  electrical  activity  in 
the  brain,  being  a macroscopic  average  of  the  signals  produced  by  billions  of 
individual  neurons.  According  to  Gibbs  and  Gibbs  (1950),  "Since  the  electri- 
cal activity  of  the  human  brain  is  almost  indistinguishable  from  that  of  the 
optic  nerve  of  a water  beetle,  details  of  cellular  arrangements,  important 
though  they  are  for  some  purposes,  are  evidently  of  secondary  importance  in 
electroencephalography."  Furthermore,  there  is  no  known  correlation  between 
EEG  at  a point  of  the  skull  and  the  function  of  that  part  of  the  brain  beneath 
the  point. 

On  the  o-^-her  hand,  EEG  signals  show  important  variations  with  the  state 
of  activity  of  the  subject  and  from  individual  to  individual.  In  general,  the 
electrical  activity  which  correlates  best  with  changes  in  central  nervous 
function  is  the  strength  of  the  principal  frequency  co.'..ponent , although  most 
encephalographers  seem  to  feel  that  no  spectral  representation  can  adequately 
represent  the  EEG  due  to  its  non-stationary  character.  The  electrical  signals 
of  the  brain  begin  during  intra-uterine  life.  The  rhythm  is  slow  at  birth, 
but  the  frequency  increases  with  maturity.  It  slows  again  at  senility  and 
stops  with  death.  Such  effects  as  sleep,  drugs,  stage  of  menstrual  cycle, 
attention,  and  fright  also  produce  differences  in  the  dominant  frequency. 

We  have  stated  that  the  EEG  shows  inter-individual  variations.  There 
ai'pears  to  be  a genetic  factor  at  work  here,  for  the  EEC's  of  identical  twins 
are  similar  and  non-identical  twins  dissimilar.  "But  it  is  not  correct  to 
assume  that  the  electroencephalogram  is  a stable  or  easily  identifiable  char- 
acteristic of  the  individual.  It  is  as  characteristic  as  most  other  body 
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attributes;  but  many  persons  have  EEC's  which  are  practically  indistinguish- 
able from  those  of  other  persons  [1]. 

In  summary,  five  sets  of  data  have  shown  important  correlations  with  the 
EEC:  (1)  brain  metabolism,  (2)  age,  (3)  level  of  consciousness  (awake, 
asleep,  relaxed,  attentive),  (u)  certain  clinical  symptoms,  and  (5)  the 
pharmacological  action  of  certain  drugs.  "Only  in  special  types  of  cases  are 
electroencephalographic  changes  found  to  be  related  to  major  psychoses,  the 
neuroses,  psychopathy,  hysteria,  emotional  disturbances,  and  intelligence 
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Some  work  has  been  done  to  determine  whether  the  EEC  might  be  serviceable 
for  identifying  individuals.  Rather  marginal  results  were  obtained  by  Bukhout 
and  Walter  [3]  under  controlled  conditions.  In  light  of  the  latter  research, 
the  aforementioned  variability  with  state  of  attention,  and  the  low  voltage  of 
the  signals  involved  we  consider  use  of  the  EEC  as  a successful  entry  access 
discriminant  highly  improbable. 

A related  technique,  however,  would  appear  much  more  adaptable  to  our 
purposes.  It  has  been  observed  that  the  EEC  recorded  in  the  time  immediately 
following  a stimulus  is  repeatable.  The  waveform  recorded  (usually  for  300  - 
400  msec  after  the  stimulus)  is  somewhat  unique  to  the  type  of  stimulus,  the 
intensity  of  the  stimulus,  and  the  individual.  It  is,  moreover,  repetitive  in 
time.  Since  the  "evoked  potential"  is  a response  to  an  observer-contixilled 
event,  averaging  techniques  are  employed  to  enhance  the  signal.  A common 
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stimulus  is  a flash  of  light,  in  which  case  the  waveforms  are  known  as  "visu- 
ally evoked  potentials"  (VEP).  The  VEP  is  roughly  ten  times  the  EEC  In 
voltage  amplitude. 

We  postulate  that  the  entrance  access  control  through  use  of  the  VEP 
would  require  the  candidate  to  clip  a ground  electrode  (dry  or  capacitative ) 
to  his  earlobe  and  view  a photic  stimulus  through  a binocular  viewing  device. 
The  subject's  head  would  depress  a second  electrode  in  the  frontal  position. 
The  VEP  of  a subject  for  various  light  levels  would  be  stored  in  the  system. 

On  any  day  one  of  these  levels  will  be  chosen  at  random  and  the  light  flashed 
at  irregular  intervals.  The  measured  VEP  would  then  be  compared  with  the 
known  VEP  for  that  light  intensity  and  access  status  determined. 

To  evaluate  the  VEP  in  regard  to  separability,  we  irav  make  use  of  the 
work  of  Dustman  and  Beck  [*♦].  In  Figure  D-8  we  reproduce  the  VEP  of  Dustman 
and  Beck  for  four  individuals  labeled,  D.H.,  D.F.,  R.D.,  and  R.W.  Each  curve 
for  each  individual  is  itself  an  average  of  100  light  flashes.  The  various 
curves  for  the  individuals  were  taken  at  intervals  of  days  and  weeks.  Thus, 
long  tern  stability  of  the  VEF  is  demonstrated.  Furthermore,  it  is  obvious 
from  Figure  D-8  that  there  is  substantial  inter-individual  variability. 

Dustman  and  Beck  sampled  the  waveform  for  300  msec  at  25  points.  This  sam- 
pling rate  is  consistent  with  other  sources  which  put  the  typical  maximum 
frequency  com.ronent  in  the  EEG  at  100  Hz.  Their  data  showed  an  intra- individ- 
ual correlaticn  ranging  from  .72  to  .99  for  seven  subjects,  with  a median 
val..e  of  ,88.  The  inter-individual  correlations  proved  to  be  much  smaller, 
ranging  from  -.29  to  .92,  with  median  .37.  Thus,  in  the  context  of  Appendix 
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Figure  D-B 

Reliability  and  individuality  of  the  evoked  potentials.  The  first 
four  illustrations  show  the  superimposition  of  four  averaged 
evoked  responses  recorded  at  weekly  or  longer  intervals  from  subjects 
D.H.,  D.F.,  R.C.,  and  R.W,  The  fifth  shows  the  superimposition  of 
the  evoked  responses  of  all  four  subjects. 
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B,  the  dimensionality  of  the  feature  space.  A,  is  25,  the  o j values  may  be 
taken  at  12%  of  the  mean  values  of  the  measurements,  while  the  ranges  appear 
to  be  63%.  Taking  F.^^,  the  type  1 1 error  rate  as  .02,  we  find  from  the  appen 
dix  that  for  300  subjects 


k 


( 


.02 

300 


) 


1/25 


3.57. 


The  Type  I error  rate  derived  from  this  value  of  k is  given  by 
(1  - ' = erf  (V//7). 


This  latter  equation  may  be  reduced  to 


E 


I 


rxp  /2) 


for  large  k and  small  E^.  Thus 


Ej  = .0027. 

Consequently,  we  rate  the  technique  of  VEP  at  100  in  the  separability  category. 

V.'e  rate  the  VLP  at  80  in  the  Technological  Feasibility  category.  The 
electrode  structure  would  require  large  modification  of  existing  equipment. 

The  deve  costs  are  apt  to  be  somewhat  higher  than  in  the  case  of 

the  ECG.  One  wo’  .'obably  begin  with  standard  electrodes  and  record  data  cn 
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two  channels  of  an  analog  tape  recorder,  as  timing  and  a signal  channel.  This 
would  be  digitized  at  a later  time  for  signal  averaging.  The  low  voltages 
involved  and  the  time  required  to  develop  expertise  in  the  physiological 
aspects  of  the  problem  would  both  serve  to  increase  costs.  Purchase  and 
operational  costs  do  not  appear  excessive.  We  rate  the  VEP  at  60  in  the  cost 
category. 

If  300  msec  of  VEP  are  to  be  examined,  the  maximum  flash  rate  is  .33  Hz. 
I-  ten  seconds  33  waveforms  could  be  secured  for  averaging.  This  number  would 
probably  be  adequate  since  the  increase  in  signal-to-noise  in  going  from  33 
waveforms  to  100  in  only^TT  We  rate  the  speed  category  at  90. 

Because  control  of  the  rate  and  level  of  the  stimulus  would  be  variable, 
any  device  for  penetration  would  have  to  incorporate  sensors  and  would  be,  in 
our  estimation,  quite  expensive  to  build.  We  rate  the  penetrability  factor  at 
80. 
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VISUALLY  nVOKED  MAGNETOENCEPHALOC.RAM  (VEM) 


The  oscillating  electric  potentials  of  the  electroencephalop.ran* 

which  are  detectable  at  the  scalp  are  presumably  associated  with  electric 

currents  in  the  brain.  Recently,  magnetic  fields  of  the  brain  have  been 

discovered.  These  exceedingly  weak  fields  are  thought  to  arise  from 

the  same  currents  which  produce  the  scalp  potentials.  Oscillatory 

-8 

magnetic  fields  of  the  order  of  2 x 10  gauss  for  s()ontaneous  alpha 

-9 

frequencies  and  of  the  order  of  5 x 10  gauss  for  visually  evoked  fields 

have  been  observed  (Brenner,  Williamson,  and  Kaufman,  1975).  The  typical 

noise  level  obtained  by  these  authors  in  an  unshielded  laboratory  in 

-8 

Manhattan  was  typically  3 x 10  gauss  in  a band  from  5 to  25  Hz. 

The  study  of  the  VEM  has  only  begun  and  it  is  consequently  impossible 
to  judge  the  uniqueness  of  indiyidual  VEM's.  It  seems  a safe  assumption, 
however,  that  the  uniqueness  and  repeatability  of  the  VEM  will  bo 
comparable  to  that  of  the  Visually  Evoked  Potential.  Like  the  Potential, 
the  VEM  is  thus  of  possible  interest  for  individual  identification.  The 
advantage  of  the  magnetic  technique  over  the  electric  is  the  fact  that 
the  magnetic  pick~up  coil  is  positioned  2 cm  away  from  the  scalp,  whereas 
the  Electroencephalographic  electrodes  must  be  cemented  to  the  scalp. 

The  most  successful  device  for  detecting  weak  biomagnetic  fields 
[1,2]  employs  a superconducting  quantum  interference  device  (SQUID). 

Since  a SQUID  requires  liquid  helium  temperatures,  the  cost  to  operate 


A 
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SALIVA 


Saliva  collection  is  relatively  easy  with  a cooperative  person  and  is 
certainly  less  obtrusive  and  non-invasive  than  blood  collection.  Since  a 
saliva  sample  of  0.3  millileters  is  all  that  is  required  for  criminal  investi- 
gations (in  wiping  saliva  from  a bite  mark),  a sample  collection  well  above 
this  minimum  can  be  obtained  from  a cooperative  person  by  merely  having  that 
person  spit  into  a bottle  or  wipe  the  tongue  with  a clean  cotton  swab.  The 
use  of  saliva  testing  required  a two-hour  laboratory  procedure  in  1<^74  but  new 
methods  have  reduced  this  to  15  minutes  in  1975.  further  automated  tests 
could  reduce  the  classification  time  even  further.  The  end  result  of  a quick 
test  would  not  likely  be  a unique  identification  but  rather  limited  to  the 
classification  of  human  blood  types  A,  B,  or  0.  As  in  the  case  of  blood,  a 
cellular  test  examination  can  achieve  a unique  identification  except  between 
identical  twins.  The  saliva  test  can,  therefore,  at  best  provide  one  measure- 
ment — blood  type  --  in  a time  on  the  order  of  15  minutes.  There  is  no 
evidence  that  this  time  factor  can  reliably  be  reduced.  Further  investigation 
and  tests  would  be  necessary  to  determine  the  feasibility  of  an  autor.atic  test  ■ 

of  5 minutes  or  less. 

This  attribute  is  thus  considered  to  have  some  potential  identification 
capability  in  the  5 minutes  or  less  time  frame  that  this  contract  requires  but 
is  assigned  a .econdary  roll  — especially  since  it  could  probably  only  contri- 
bute to  identification  by  blood  group  in  such  a time  frame.  A longer,  more 
tedious  cellular  test  procedure  would  be  required  to  attain  an  individual's 


identification. 
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I’.  13.  BLOOD  COMPOSITION 


Tho  uriiq’ieness  of  an  individual's  blood  has  boon  an  accepted 
lu*Iiof  for  centuries.  E^xaminat  ion  of  some  of  the  comnun  traditions  and 
^.avin)»s  passed  from  (generation  to  generation  give  credence  to  this 
observation,  lor  example,  to  sign  ones'  name  in  blood  is  to  put  an 
inescapable  stamp  of  individuality  on  the  signature.  In  the  rite  of 
"blood  brothers,"  practit-  1 b.  Tran,  American  Indian  tribes,  the  blood 
(or  symbolically  the  idem  it  lo.. ) of  two  individuals  are  mixed  so  that 
tiiey  become  "one." 

TE.c  I'iological  identification  of  blood,  however,  was  .low  in  coniing 
a:;',  it  was  not  until  1901  that  any  breakthrough  occurred.  Two  major 
di.  :overie.  were  made,  on  february  7,  Paul  Uhlenliuth  announced  a method 
by  .vnich  liuman  blood  could  be  distinguished  from  animal.  This  had 
pi'ofound  effect  in  the  field  of  criminology.  Tlie  second  and  probably 
more  important  maior  finvl  was  the  outgrowth  of  medical  tragedy.  Blood 
ti’ansfusions  were  tieing  pion'.ered  at  that  time,  however,  with  disastrous 
results.  .Nearly  half  of  the  patients  receiving  blood  transfusions 
•./‘■■re  dying  and  it  was  not  until  c .reful  autopsies  were  performed  that 
the  r-  iST'ai  wa  fonn.l.  i-e.ith  .nad  been  caused  by  the  coagulation  of  the 
pat  lent j'  and  donors'  l lood.  I'r.  Karl  Landsteiner  pursued  this 
: ’ ■ n-im-na , and  eventually  dt  vised  a typing,  or  grouping  system  foi' 

I’ord  fa  ' n antip,en-ant :l<)dy  reactions.  This  system  became  known  as 
...  . The  antigens  in  the  .ABO  system  are  A and  B and  the  two  antibodies 


I 


D-77 


are  Anti-A  and  Anti-B.  In  Table  D-4  w»-  -.ee  how  the  various  blood  types 
are  descinbed. 

The  question  of  whether  an  individual's  blood  is  unique  cannot  be 
answered  t'y  application  of  iust  the  ABO  system,  for  example.  Current 
methodology  (in  the  field  of  forensic  serology)  would  require  the  typing 
of  blood  by  many  systems  before  one  could  be  reasonably  sure.  To 
accomplish  this,  emphasis  would,  for  the  most  part,  be  put  on  the 
development  of  the  sera  and  corresponding  application  techniques  required. 
This  is  where  the  difficulty  lies,  for  as  Culliford  [1]  says,  "It  is  not 
yet  possible  to  individualize  blood  in  the  same  way  as  one  can  a finger- 
print, but  this  is  because  of  a lack  of  knowledge  of  techniques  and  not 
because  of  the  nature  of  blood." 

Pursuing  the  question  of  individuality  of  human  blood,  suppose  we 
were  required  to  give  only  a high  probability  (possibly  98%)  of  correctly 
characterizing  one  person  (by  a description  of  his  blood)  from  a group  of 
others.  This  is  essentially  what  would  be  required  of  most  site  security 
systems.  To  e;:amine  whether  this  problem  could  be  practically  solved  we 
first  look  to  population  distributions  from  some  of  the  most  common  blood 
typing  systems. 

The  MN  and  Rh  systems  are  completely  independent  of  the  ABO  system. 
The  principles,  however,  are  the  same  - detection  of  specific  blood  group 
features  by  the  agglutination  of  red  cells  by  specific  anti-sera.  The 
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Blood  Type 
(Antigens) 

Antibodies  to 

Cause  Agglutination 

Blood  Type  Causing 
Agglutinat ion 

A 

Ant i-A 

B or  0 

B 

Anti-B 

A or  0 

AB 

Ant i-A  and/or 

Anti-B 

A,  B,  0 

0 (neither  A or  B) 

None 

None 

Table  D-4 


population  perconta/^e.';  [?]  for  the  ABO,  MN  and  Rh  systems  are  given  in 
Table  P-5. 


I 

i 

r 


The  Kidd  f-]  system  separates  the  population  further,  as  Table  D-6 
sho.vs.  If  a group  of  peop^le  were  typed  by  all  four  systems,  the  maximum 
probability  (PMAX)  of  two  people  being  typed  the  same  would  be 


PMAX  = (.44)  X (.27)  X (.32)  x (.51)  = .0194  2%. 


Hence,  approximately  two  people  in  one  hundred  would  be  typed  the 
same  (again,  this  is  the  worst  case). 

If  other  systems  such  as  the  Kell,  Lutheran,  and  Lewis  were  added 
to  the  previous  four,  the  maximum  percentage  would  drop  to  about  1%. 

The  possibilities  seem  quite  good  that  blood  typing  can  yield  acceptable 
Type  II  errors,  and  would  probably  have  a very  acceptable  Type  I error 
rate  given  adequate  implementation  techniques.  This  is  further  verified 
by  Fisher  [2]  who  arranged  the  maior  groups  in  the  order  of  their 
inability  to  distinquish  between  any  two  samples  of  blood.  He  found  the 
following; 


System 

Percentage  Failure 

M'JSs 

16.4 

Rh 

19.5 

A^A^BO 

32.8 
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System 

ABO 


MNSs 


Rh 


Ant igens 

"2 

B 

A^B 

A,B 

0 

MNS 

MsNs 

MMS 

NsNs 

MsMs 

NNS 

CDe/cde 

CDc/CDe 

cde/cde 

CDe/cDF. 

cDE/cde 

Others 


Percent  of  Population(CnRlish) 
35 

9.5 

8.5 
2 

1 

44 

27 

23 

21 

15 

8 

7 

32 

17 

15 

12 

11 

13 


I 


Table  D-5 
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I Tx£e 

I Jk(a+,  b-) 

Jk(a+,  b+) 
Jk(a-,  b+) 


Table  D-G 


System 

Percentage  Failure 

Kidd 

37.5 

Puffv 

38.3 

Lewis 

56.7 

66.6 

Kell 

83.7 

Lutheran 

85.9 

Employing  all  these  systems  we  could  expect  a probability  of  .04%  that 
we  would  not  correctly  distinguish  one  person  from  anothei'.  In  effect, 
the  preceding  statistic’s  serve  to  emphasize  the  potential  of  blood 
typing  as  a means  of  personal  identification.  Hence,  in  terms  of 
separability,  blood  typing  would  rate  approximately  99. 

User  acceptability  of  a blood  typing  security  system  will  be  heavily 
influenced  by  the  means  provided  for  the  extraction  of  fresh  blood  samples 
for  each  of  the  required  tests.  Obviously,  people  will  not  be  receptive 
to  any  pain,  disease,  or  infection-causing  method.  This  factor  of 
personal  risk  and  invasion  is  not  overcome  by  presently  available 
methods.  Other  possible  methods  of  obtaining  blood  typing  information 
have  been  examined.  For  example,  we  note  that  secretors'  blood  group 
factors  are  not  only  present  in  blood,  but  in  saliva,  tears,  persperation , 
etc.  However,  secretors  [3]  make  up  only  80-85%  of  the  population. 

Hence,  based  on  the  currently  available  methods,  user  acceptability 


would  be  rated  0. 


Other  factors  also  inhibit  the  use  of  blood  typing  at  this  time. 

For  instance,  in  a working  environment,  given  that  a method  of  blood 
extraction  was  acceptable,  the  blood  would  be  typed  in  some  automated 
way.  The  fresh  blood  would  be  collected  in  a flask  of  some  kind; 
separated  into  N smaller  flasks  (one  for  each  of  the  N blood  typing 
tests)  and  input  to  the  machine  which  would  mix  each  of  the  N samples 
with  the  correct  serum.  The  samples  would  then  move  through  a precise 
array  of  procedures.  Ultimately,  a reading  for  each  of  the  N tests  would 
be  output.  A device  called  the  Autoanalyzer  is  currently  available  and 
works  in  this  manner.  It  is  felt  that  only  slight  modification  to  the 
machine  would  be  necessary  since  it  is  specifically  designed  to  automate 
the  blood  typing  process.  Some  interface  with  a logic  device  capable  of 
interpreting  the  output  would  be  necessary.  The  primary  drawback  is  the 
high  cost  of  the  device. 

In  summary,  blood  typing  as  a means  of  personal  identification  holds 
much  promise.  However,  until  sufficient  quantities  of  blood  can  be 
obtained  easily  and  acceptably  or  blood  factors  can  be  obtained  from 
other  parts  of  the  anatomy  from  all  people,  it  will  probably  be  unaccept- 
able from  the  view  of  user  acceptability. 
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ODOR  AND  SWEAT 


Although  odor  and  sweat  do  appear  to  have  good  identification 
potential,  their  measurement  is  extremely  difficult  and  beyond  the  present 
state  of  the  art.  One  easy  method  used  by  police  today  is  the  use  of 
odor-detecting  dogs.  The  individual's  odor  can  be  compared  to  that  of 
the  original  by  using  a piece  of  the  original  individual's  clothing  or 
a piece  of  cloth  that  the  individual  has  handled  as  a reference. 

Scent  is  transmitted  to  the  cloth  by  a direct  transfer  of  skin 
secretions,  cells,  and  bacteria.  Cotton  gloves  would  make  a good 
"scent  article."  Although  it  may  sound  silly,  a trained  dog  is  worthy 
of  consideration  for  this  personal  attributes  study  because  it  is  not 
expensive,  it  is  available  now,  and  it  is  fast  in  recognizing  scent. 

Also,  by  making  it  easy  for  the  dog,  using  a controlled  environment 
and  cooperative  individuals  to  simply  put  on  a pair  of  cotton  or 
paper  gloves,  the  dog's  bark  is  a positive  signal  correlation.  Trained 
gerbils  are  currently  being  tested  for  detection  of  explosives  by  odor. 

Cells  within  our  body  have  a definite  life  span,  and  the  epidermis 
is  constantly  being  replaced.  The  body  odor  is  produced  bv  bacteria 
acting  upon  the  dead  cells,  residues,  and  body  secretions.  Added  to 
this  activity  is  the  use  of  toiletry  preparations  and  clothing,  and  the 
individual  reaction  to  all  of  these  components.  Human  odor  is  undoubtedly 
very  complex  and  very  individualistic.  There  is  probably  a basic  odor 
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which  is  typical  of  each  individual.  This,  in  turn,  can  likely  be  varied 
somewhat  by  emotions,  toiletries,  clothing,  and  diet.  These  complex 
interactions  alone  can  account  for  millions  of  variations  of  human  odor. 

The  success  in  the  use  of  dogs  to  detect  scent  is  well-known  from 
prior  war  and  police  work.  German  Shepherds,  Schnauzers,  and  Doberman 
Pinschers  are  the  best  known  trained  dogs. 

The  measurement  of  odor  by  other  techniques  is  still  theoretical 
based  on  ideas  of  molecular  vibrat ions  in  resonant  frequency  ranges  as 
described  in  the  references  to  Wright,  Davies,  Amoore,  and  Dravmek's 
theories . 

The  use  of  a dog  in  odor/sweat  detection  is  therefore  the  recommended 
solution  to  this  attribute. 
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D.15.  HEIGHT  AND  WEIGHT 

An  individual's  height  and  weight  are  personal  attributes  which  have  long 
served  as  crude  identification  characteristics,  serving  in  applications 
ranging  from  driver's  licenses  to  Selective  Service  records.  The  fluctuations 
expected  in  both  these  quantities  are  large  and  of  an  obvious  source.  Never- 
theless, together  they  might  serve  as  a useful  zero-order  classifier.  Further- 
more, they  are  inexpensively  and  reliably  transduced.  Finally,  we  may 
consider  height  and  weight  as  prototypes  for  a long  string  of  crudely  measured 
attributes  which,  through  sheer  numbers,  meet  our  criteria.  Ir  any  case,  it 
is  useful  to  analyze  height  and  weight  (HW)  as  a benchmark  against  which  to 
compare  other  techniques.  It  is  educational  to  analyze  HW  to  see  how  the 
formulas  developed  in  Appendix  B will  apply. 

Weight  is  easily  transduced,  perhaps  through  a piezoelectric  crystal 
attached  to  the  "floor"  of  the  access  booth.  Height  could  be  measured  by 
placing  a line  of  emitter-receiver  LED  pairs  along  each  side  of  the  booth. 

The  last  pair  remaining  uninterrupted  would  measure  the  individual's  height. 

In  Figure  D-10,  we  show  a height-weight  scatter  plot  for  64  PAR  employees. 
The  plot  shows  the  correlation  of  large  height  with  large  weight  that  we  would 
expect.  The  range  of  the  data  is  an  ellipse  of  "volume"  roughly  60  squares, 
each  of  area  10  lb-inches  for  a total  volume  V of  600  lb-inches.  Assuming  an 
individual's  weight  is  apt  to  fluctuate  ^5  lb  due  to  clothing  and  the  weight 
variations  and  ^2  inches  due  to  heels,  the  resolution  cells  are  of  volume  20 
lb-in.  Hence,  there  are  roughly  30  bins  into  which  a coarse  sorting  by  height 
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and  weight  would  classify  individuals.  Thus  the  Type  II  Error  rate  of 
approximately  3%  is  unacceptable  (see  Appendix  B). 

We  can  estimate  the  number  of  additional  features  of  this  type  that  we 

would  require.  Taking  \/30  we  attribute  5 separation  bins  to  each 

3 

dimension  of  feature  space.  Now  5 = 125,  which  would  xesult  in  an  acceptable 

Type  II  Error  rate. 

As  a suggestion  for  another  feature  which  might  prove  useful,  we  consider 
measuring  an  individual's  density.  Since  we  already  have  measured  the  sub- 
ject's weight,  we  need  only  measure  his  volume  to  ascertain  density.  This 
might  be  done  by  subtracting  the  volume  of  the  access  chamber  cum  subject  from 
the  Known  volume  of  the  access  chamber.  If  the  chamber  is  pressure  tight, 
then  by  monitoring  the  pressure  and  temperature  of  the  chamber  while  the 
volume  is  changed  by  a (small)  known  amount,  the  residual  volume  may  be 
determined.  If  this  small  known  volume  change  is  produced  by  a diaphragm 
driven  sinusoidally  at,  say  100  Hz  frequency,  the  residual  volume  should  be 
measurable  to  high  precision. 
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GAIT 


Gait  can  be  categorized  by  a crude  type  of  description  by  observing  a 
person's  walk  over  a distance  of  10  to  20  feet.  It  has  been  used  to  identify 
a person  in  police  work  along  with  other  evidence,  but  it  is  not  easily 
adapted  to  computer  automation.  The  human  observer  can  classify  gait  by 
posture  and  style  as: 

Brisk 

Active 

Hurried 

Slow 

Measured 

Pompous 

Hesitant 

Awkward 

Shuffling 

Limping  or  Lame 

Head:  forward,  back,  to  one  side 
Arms:  swinging,  hanging,  across  body 

Knees:  bent,  high  stepper,  leg  swings  forvard  or  sideways 
Feet:  pigeon-toed,  splayed  out,  flat,  toe  spring 
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ELLCTKOCARDIOGRAPHY 


One  of  the  most  well-known  bioelectrical  sip.nals  is  tfie  electrocanlio- 
gram  (ECG).  The  ECG  signal  arises  from  contraction  of  the  heart  muscle  and 
is  therefore  a repetitive  waveform  with  the  period  of  the  heart  beat.  The 
contraction  of  the  heart  muscle,  like  all  muscular  contraction,  is  initiated 
by  an  electrical  signal  carried  by  the  nerves.  In  the  case  of  the  heart, 
the  origin  of  the  signal  is  the  sino-atrial  node  (under  control  of  the 
central  nervous  system),  the  natural  pacemaker  of  the  body.  The  signal 
propogates  along  the  bundle  of  His  to  arrive  at  appropriate  points  of  the 
heart  ventricles  so  as  to  create  a coordinated  contraction  of  the  heart. 
Because  of  the  conductivity  of  the  body's  electrolytes,  the  electrical 
signal  which  activates  the  heart  can  be  detected  as  voltage  differences 
between  points  at  the  body's  surface. 

There  are  a variety  of  systems  for  electrode  placement.  Limb  leads 
are  attached  at  both  wrists  and  an  ankle  while  the  second  ankle  serves  as 
"chasis"  ground.  The  six  standard  chest  leads  are  positioned  near  the 
lieart.  In  most  present  applications,  the  resistance  between  skin  and 
electrode  is  lowered  by  use  of  electrolytic  paste.  One  period  of  a typical 
f;CG  is  shown  in  Figure  D-11,  althougfi  the  character  of  the  wave  will  depend 
upon  the  electrode  pair  chosen.  The  points  on  the  waveform  have  been 
tlenoted  P,  Q,  R,  S,  and  T,  with  the  P wave  arising  from  the  atrial  contrac- 
tions, the  QRS  wave  from  the  main  ventricular  contractions,  and  the  T wave 
fi’om  the  resetting  operations  requii'eii  for  the  next  beat.  The  typical 
voltages  of  the  R maxima  are  't'2  mV  in  the  limb  leads. 
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We  now  turn  to  the  question  of  whether  an  individual's  ECG  is  a unique 
personal  attribute  which  can  be  used  for  identification  pruposes.  Since  the 
ECG  is  a clinical  tool  for  the  discovery  and  evaluation  of  cardiac  problems, 
it  has  been  necessary  to  study  extensively  the  range  of  normal  ECG's.  The 
individuality  encountered  is  encouraging  to  the  prospects  of  identification. 
For  example,  Burch  and  DePasquale  [1]  state  that,  "The  major  difficulty  in 
establishing  normal  electrocai'diographic  standards  is  the  extreme  variability 
of  the  electrocardiogram  in  healthy  subjects."  One  of  the  early  investiga- 
tors [2]  even  suggested  the  use  of  the  ECG  as  an  identification  technique! 

There  is  a great  number  of  variables  which  affect  the  shape  of  the 
electrocardiogram.  Some  of  those  variables  are  associated  with  physiological 
attributes  of  the  individual  and  benefit  the  identification  problem.  Other 
variables  will  result  in  day-to-day  variations  of  an  individual's  ECG  and 
will  consequently  aggravate  the  identification  problem.  In  Table  D-7,  we 
list  the  variables  in  these  two  categories  and  appropriate  references. 

In  Section  2.2.  we  have  described  our  evaluation  criteria.  The  next 
several  paragraphs  contain  our  assignments  of  numerical  values  to  the 
criteria  for  the  ECG. 

The  measurement  technique  is  as  follows.  Two  dry  electrodes  will  be 
provided  to  which  the  subject  will  touch  one  finger  of  each  hand.  The 
entrance  booth  will,  in  addition,  be  equipped  with  a binocul.ir  viewing 
device  and  touch  a third  dry  electrode  to  his  forehead  which  will  serve  as 
a ground.  The  electrodes  will  bo  pi’essure  sensitive  so  that  data  acquisi- 


n-96 


VaridbJes  which  affect  inter-irulividual  differences; 


1. 

Cardiac  Position 

[1] 

o 

Chest  Conf ij’.uration 

[1] 

3. 

Relative  Obesity 

[1] 

4. 

Ago 

[1] 

Variables  whicli  affect  intra-individual  differences: 


1 . 

Digestion 

[3] 

2. 

Respiration 

[4], 

[71,  [141 

3. 

Baseline  Shifts 

[4] 

4. 

Fxerc ise 

f5J, 

[61 

5. 

Emot ion 

fiol 

, [111,  [121, 

6. 

Drugs 

[81, 

[91 

7. 

Posture 

[71 

a. 

Electrode  Placement 

[71 

Table  n-7  Variables  Affecting  F.CG's 


tion  will  commence  once  all  three  electrodes  are  iepressed.  The  limb  lead 
ECG  between  the  two  hands  will  be  sampled  at  lOe  dz  by  a low  speed  ADC  for 


! 


approximately  3 seconds  to  record  3 heart  beats.  The  signal  will  be  input 
to  an  on-line  processor  to  identify  or  reject  i he  subject. 


In  Appendix  B,  we  have  already  analyzed  ECG  in  regard  to  its  ability 
to  separate  individuals  with  the  required  Type  I and  IT  i i ror  rates  and  we 
find  as  a result  that  the  ECG  must  be  assigned  a score  o-  100  in  the 
separability  category. 

In  the  category  of  technological  feasibility,  it  remains  only  to 
discuss  the  dry  electrodes  we  have  mentioned,  as  the  amplifiers  and  other 
pieces  of  equipment  are  "off-the-shelf"  items.  Two  types  of  dry  electrodes 
have  appeared  in  the  literatui’e.  One  variety  makes  use  of  a capacitative 
coupling  in  place  of  a resistive  one  [15].  The  authors  report  results  equiv- 
alent or  superior  to  conventional  resistive  electrodes.  Another  type  of 
dry  electrode  is  simply  a silver  electrode  attached  through  circuitry  to 
simultaneously  measure,  and  hence  cancel,  skin  resistance  [16].  Neither 
of  these  electrodes  is,  to  our  knowledge,  commercially  available,  neverthe- 
less the  techniques  seem  well  demonstrated  so  that  we  have  evaluated  the 
technological  feasibility  at  90. 

The  cost  evaluation  category  includes  development,  purchase  and  oper- 
ating cost.  We  estimate  that  the  development  costs  would  be  minimal.  To 
build  and  test  the  circuits  involved  in  the  drv  electrode  circuit  discussed 
above  [16]  would  require  perhaps  two  weeks  of  engineering  time  and  two  weeks 
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of  technician  time.  The  ADC  facility  already  exists.  The  purchase  and 
operating  cost  would  largely  be  reduced  to  those  costs  associated  with  the 
pattern  classification  processor.  This  expense  is  common  to  all  identifi- 
cation attributes.  We  consequently  rank  the  ECG  at  90  in  cost. 

Speed  of  access  is  a bit  of  a problem  for  the  ECG.  Since  one  heart 
beat  is  always  required,  the  lower  bound  on  the  access  time  is  approximately 
one  second.  If  signal  to  noise  proves  a problem,  as  it  well  might  in  such  a 
non- laboratory  environment  as  is  here  envisioned,  then  four  heart  beats  will 
improve  the  signal  to  noise  by  a factor  of  two;  nine  heart  beats,  factor 
three,  and  so  forth.  At  the  moment  there  is  no  reason  to  believe  that  more 
than  3 seconds  of  data  will  be  required,  but  the  intrinsic  1 Hz  rate  of  the 
heart  beat  may  represent  a boundary  at  a later  time.  In  recognition  of  this 
fact,  we  have  assigned  90  points  in  the  speed  category. 

The  penetrability  of  our  proposed  ECG  system  is  perhaps  its  weakest 
point.  Any  technique  involving  electrodes  as  transducers  is  sub;iect  to  the 
following  penetration  strategy.  A EM  tape  recording  is  made  of  the  ECG  of 
an  individual  on  the  acceptance  list.  The  tape  recording  is  played  back 
through  the  proper  impedance  matching  devices  into  the  electrodes.  It 
eems  that  the  only  way  to  avoid  this  penetration  strategy  is  to  measure 
other  physical  attributes  simultaneously.  On  the  other  hand,  the  tape 
r. -cording  of  .m  inci ividual ’ s ECG  would  probably  require  his  cooperation.  We 
issign  a score  of  70  to  the  ECG  in  the  penetration  category. 
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OTHER  TYPES  OF  CARDIOGRAPHY 


There  are  several  other  cardiac  diagnostic  techniques  which  might  be 
considered  useful  for  extracting  personal  attributes.  All  of  the  techniques 
we  shall  mention  subsequently  are  similar  in  that  they  measure  fluid  motion 
and  displacement  produced  by  the  beating  heart. 

Ballistocardiology  (Starr  and  Noordergraof , 1967)  employs  the  fact  that 
the  momentum  of  the  blood  flowing  toward  the  feet  (or  any  other  point  of  the 
body)  does  not  equal  the  momentum  of  the  blood  flowing  in  the  opposite  direc- 
tion at  every  instant  of  time.  To  maintain  the  center  of  mass  of  the  body 
fixed,  the  remainder  of  the  body  moves  in  the  opposite  direction.  The  result- 
ing motion  is  a complicated  periodic  function  which  is  sensitive  to  heart 
stroke,  blood  volume,  timing  of  the  heart  valves,  blood  pressure,  etc.  The 
ballistocardiac  motions  of  the  body  can  be  observed  by  anyone  standing  on  a 
sensitive  spring  scale  and  has  consequently  been  rediscovered  more  than  once 
in  the  history  of  medicine  since  J.W.  Gordon  produced  the  first  ballistocar- 
diogram (BCG)  in  1877. 

The  ballistocardiogram  is  affected  by  many  of  the  same  variables  listed 
in  Table  D-7  for  ECG's.  According  to  Starr  and  Noordergraaf  (1967)  height, 
weight,  body  volume,  age,  sex,  respiration,  digestion,  drugs,  and  emotion  are 
all  important  considerations.  Consequently,  we  may  expect  substantial  inter- 
individual dispersion,  as  in  the  case  of  ECG.  Indeed,  "Records  of  healthy 
persons  do  show  small  differences  from  one  another,  and  these  differences  are 
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so  characteristic  that  the  senior  author  soon  learned  to  identify  his  friends 
by  a glance  at  their  records"  (Starr  and  Noordergraaf , 1967). 

Although  modern  ballistocardiography  requires  the  patient  to  lie  on  a 
table  with  sensitive  (usually  air)  bearings,  a usable  record  may  be  obtained 
from  a subject  in  a vertical  position.  Building  vibrations  must  be  reckoned 
with  in  the  latter  case  as  the  amplitude  of  the  motion  is  greatly  reduced. 

For  the  BCG  employed  as  an  entry  access  control,  we  envision  an  entry  booth 
with  floor  entirely  composed  of  a bearing  platform.  The  motion  of  the  platform 
must  be  damped  to  avoid  initial  oscillations  when  the  subject  enters  the 
booth.  The  mechanism  must  then  be  unlocked  and  rapidly  brought  to  a sensitive 
state . 

For  ballistocardiography,  it  has  not  been  possible  to  find  the  detailed 
inter-  and  intra-individual  variation  statistics  similar  to  those  employed  for 
evaluating  ECG's  because  of  the  relatively  small  number  of  institutions  uti- 
lizing the  BCG.  Nevertheless,  it  seems  reasonable  to  argue  from  analogy  with 
ECG's  that  the  BCG  should  score  100  in  the  separability  category. 

In  regard  to  user  acceptability,  we  rote  that  the  BCG  requires  no  elec- 
trodes. On  the  other  hand,  the  subject  will  be  forced  to  cooperate  to  the 
extent  of  remaining  motionless  and  perhaps  hold  his  breath  for  the  duration  of 
the  measurement,  several  heartbeats  at  least. 

To  promote  the  BCG  access  control  to  the  status  of  technologically 
feasible  requires  a large  modification  of  existing  equipment  to  convert  the 
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presently  available  table  devices  into  a platform.  The  locking  mechanism 
which  will  be  engaged  when  the  subject  enters  the  access  port  and  the  mechan- 
ism for  adjusting  the  platform  to  equilibrium  under  the  subject's  weight 
remain  to  be  developed.  We  rate  the  BCG  at  70  in  the  technological  feasibil- 
ity category. 

The  development  cost  of  the  BCG  is  apt  to  ruii  into  hundreds  of  thousands 
of  dollars  since  data  collection  will  require  purchase  of  a commercial  BCG 
unit.  The  purchase  cost  will  also  be  much  higher  liian  for  ECG  since  the 
contemplated  unit  would  be  a special  production  item.  Operating  costs  appear 
reasonable.  We  rate  the  BCG  at  70  in  the  cost  category. 

It  seems  that  the  BCG  access  control  technique  may  be  expected  to  require 
approximately  5 seconds.  Two  seconds  are  allotted  for  bringing  the  platform 
to  equilibrium  and  3 seconds  to  record  three  heart  beats.  We  rate  the  speed 
category  at  90. 

The  BCG  is  quite  interesting  in  its  impenetrability.  Suppose  an  intruder 
builds  a device  capable  of  simulating  the  accelerations  of  a person  on  the 
acceptance  list.  First  of  all,  this  would  be  a rather  sophisticated  device. 
Secondly,  the  intruder  would  be  forced  to  remove  his  own  BCG  signal  from  the 
platform,  perhaps  by  elevating  himself  off  the  floor  by  a rod  attached  between 
the  walls  of  the  access  port.  We  might  expect  such  abnormal  behavior  to  be 
easily  detectable.  We  rate  the  BCG  at  90  in  the  penetrability  category. 
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Phonocardiology  is  simply  electronically  assisted  auscultation.  The 
motion  of  the  blood  and  the  openings  and  closings  of  the  heart  valves  produce 
sounds  which  are  picked  up  by  a microphone  attached  by  pressure  to  the  chest. 
Again,  in  relation  to  ECG,  very  little  quantitative  information  is  available 
as  to  the  variations  found  in  the  normal  population.  Two  facts,  however,  are 
pertinent.  On  the  plus  side  we  note  that  the  phonocardiogram  (PCG)  contains 
frequency  components  up  to  1000  Hz  so  we  might  expect  a higher  dimensionality 
of  feature  space  than  the  ECG.  The  principal  drawback  of  PCG  is  the  sensi- 
tivity of  the  record  to  placement  of  pickup  microphone  and  to  the  acoustic 
coupling  achieved  between  microphone  and  chest.  We  recommend  that  the  PCG  not 
be  utilized  over  the  ECG  due  to  the  many  variables  which  it  seems  difficult  to 
evaluate  without  further  experimental  data. 

The  same  remark  applies  to  an  even  greater  extent  to  echocardiography  and 
displacement  cardiography.  Echocardiography  employs  ultrasound  and  records 
the  time-varying  acoustic  properties  of  the  chest  through  the  heart  cycle. 
Displacement  cardiography  likewise  records  the  time  varying  velocity  of  the 
heart  and  tissue  of  the  chest  in  response  to  the  cardiac  cycles.  The  displace- 
ment cardiograph  utilizes  an  oscillating  magnetic  field  and  measures  the 
inductance  changes  produced  by  moving  tissues.  Both  of  these  cardiographic 
techniques  would  be  quite  sensitive  to  the  position  of  the  subject  and  rather 
expensive  to  develop.  Consequently,  we  feel  that  neither  can  be  competitive 
with  ECG  and  we  eliminate  them  from  consideration. 
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QUESTION  AND  ANSWER  (Q/A)  SYSTEMS 


The  system  to  be  described  here  is  derived  in  part  from  suggestions  by 
Martin  [1]  in  connection  with  computer  terminal  security  procedures.  As  the 
user  signs  on,  the  computer  asks  the  user  a sequence  of  personal  questions. 
Questions  have  been  selected  in  such  a way  that  only  the  authorized  user  knows 
the  correct  answer,  and  which  he  is  not  likely  to  forget.  (This  will  reduce 
the  tendency  of  some  users  to  write  down  the  correct  answers  in  a diary  or 
notebook,  where  they  might  be  stolen.  This  is  a serious  objection  to  the 
usual  passwords  or  security  code.) 

Martin  gives  the  following  examples  of  questions  which  might  be  employed: 
"When  is  your  wife's  birthday?.  What  is  the  first  name  of  your  grandmother?. 
What  is  your  Aunt  Mary's  maiden  name?"  The  computer  selects  a small  number  of 
such  questions  from  a larger  number  stored  for  that  person.  It  need  not  ask 
the  same  questions  each  time,  so  that  another  person  could  not  obtain  all  the 
correct  responses  by  looking  over  his  shoulder  or  tapping  the  telephone  or 
other  linkage. 

He  concludes:  "This  sign-on  procedure  has  the  advantage  of  being  easy  to 
use,  but  the  disadvantage  of  being  somewhat  lengthy  in  operation.  It  does  not 
give  a high  degree  of  security  if  the  questions  are  such  that  a persistent 
intruder  could  find  out  the  answers  to  them,  as  with  the  first  two  questions 
above. " 
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The  advantages  to  a question-and -answer  (Q/A)  system  would  be  the  fol- 
lowing: 

1.  The  user  is  not  required  to  carry  any  objects,  such  as  keys  or  cards, 
which  might  be  lost  or  stolen. 

2.  The  correct  responses  are  easily  remembered,  in  contrast  with  number 
sequences  or  code  words. 

3.  "Off-the-shelf"  equipment,  in  the  form  of  inexpensive  alphanumeric 
terminals,  is  readily  available  at  a low  price. 

Disadvantages , as  noted  by  Martin,  include  the  "somewhat  lengthy"  time 
required  for  entry,  and  the  possibility  that  a persistent  intruder  may  be  able 
to  obtain  the  answers  to  some  personal  questions. 

In  addition,  the  following  objections  should  be  considered:  if  a large 
number  of  questions  are  to  be  available  to  the  system,  the  storage  require- 
ments may  become  excessive.  A Q/A  system  may  also  encounter  resistance  from 
personnel  who  may  feel  that  personal  privacy  is  being  invaded.  (For  example, 
a request  for  the  names  of  relatives  may  reveal  ethnic  origins  which  the 
individual  properly  feels  are  irrelevant  to  his  employment.) 

The  purpose  of  the  following  discussion  is  to  show  that  these  objections 
can  easily  be  met  by  a Q/A  system. 


It  is  important  to  emphasize,  first,  that  individual  memory  uniquely 
identifies  an  individual  (Locke,  1653).  If  it  is  correct  to  say  that  no  two 
persons  have  the  same  set  of  memories,  however,  it  is  essential  to  establish 
some  sort  of  behavioral  criterion  for  determining  whether  individual  A actu- 
ally possesses  the  set  of  memories  which  he  claims. 

The  problem  is  a non-trivial  one  in  many  legal  applications,  where  it  is 
essential  to  establish,  for  example,  that  a claimant  is  actually  the  missing 
heir.  Childhood  memories  may  be  sufficient  to  establish  the  claimant's 
identity. 

For  the  purposes  of  personal  identity  verification,  however,  two  con- 
straints will  pose  serious  problems: 

First,  the  limited  storage  capacity  of  any  reasonable  computer-based 
system  will  require  that  the  system  use  only  a very  limited  number  of  ques- 
tions, which  must  further  be  restricted  to  those  which  can  be  checked  by  the 
machine.  (This  would  eliminate,  for  example,  a qualitative  description  of  the 
individual's  childhood  home,  for  which  the  data  would  be  far  too  rich  for 
effective  machine  storage  and  checking.) 

Second,  another  person,  who  may  be  assumed  to  be  a persistent,  .nalicious 
intruder,  may  be  able  to  memorize  enough  facts  about  the  person  to  be  able  to 
answer  a sufficient  number  of  questions  correctly. 
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Thus,  while  it  is  undoubtedly  true  that  an  individual's  memories  are 
unique,  it  is  not  true  that  an  individual's  behavioral  responses  cannot  be 
imitated  by  another  person. 

The  system  to  be  described  here  is  intended  to  meet  the  preceding  objec- 
tions. 

A very  simple  terminal  would  be  sufficient  for  the  Q/A  system,  consisting 
of  a keyboard  with  alphanumeric  characters,  a visible  display,  and  a non- 
volatile random-access  memory.  Because  of  the  relatively  high  cost  of  CRT 
displays,  it  may  be  suggested  that  a single  line  of  LED  characters  be  employed. 
However,  for  cost  comparison  purposes,  a small  CRT  is  used  (below). 

Memory  requirements  could  be  reduced  significantly  if  personnel  carried 
magnetically-encoded  cards.  Such  cards  would  include  correct  answers  to  a 
variety  of  questions,  which  would  be  sufficient  to  identify  the  person  author- 
ized to  carry  the  card.  However,  the  use  of  cards  would  violate  one  of  the 
constraints  imposed  upon  the  identity  verification  system,  and  other  means 
would  be  required  for  storage  of  verification  data. 

It  is  proposed  that  a very  limited  number  of  questions  be  stored,  and 
that  the  questions  be  modified  at  each  entry.  Thus,  the  data  for  any  individ- 
ual person  will  be  changing  constantly,  reducing  the  likelihood  that  a persis- 
tent intruder  will  be  able  to  memorize  a set  of  correct  responses. 
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The  proposed  dialogue  might  take  the  following  form: 


NAME  ? CLIDE  SAMUELS 
DOG'S  NAME  ? BARKLEY 
MOTHER'S  FIRST  NAME  ? BETTY 
ENTER  FATHER'S  FIRST  NAME  = DICK 
PASS 


The  first  entry  is  used  to  retx'ieve  records  concerning  the  named  person. 
If  no  such  name  appears  in  the  file  of  cleared  persons,  admission  is  denied 
and  an  alarm  sounds. 

The  next  two  entries  are  retrieved  at  random  from  the  individual's 
records.  These  are  stored  as  pairs  of  questions  and  responses.  Further 
research  will  be  required  to  determine  an  ideal  number  of  pairs  to  be  stored; 
for  the  purposes  of  this  description,  we  may  suppose  that  about  ten  Q/A  pairs 
are  stored  for  each  individual  on  an  inexpensive  random-access  device  within 
the  secure  area.  If  a mismatch  is  detected,  an  alarm  sounds. 

Finally,  the  system  requests  a new  entry,  father's  first  name.  This  is  a 
random  selection  from  a stored  list  of  possible  queries,  and  it  is  used  to 
replace  one  of  the  Q/A  pairs  already  appearing  in  the  individual  record.  The 
new  pair  will  be  available  for  identification  for  subsequent  entries. 

To  avoid  the  problems  of  personal  privacy  mentioned  earlier,  and  to  make 
it  much  more  difficult  for  imposters  to  obtain  the  correct  responses,  it 
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should  be  made  clear  to  users  that  they  need  not  tell  the  truth  in  their 
initial  answers.  The  unmarried  person  may,  for  example,  tell  the  system  that 
her  spouse's  name  is  PRINCE  CHARMING.  The  only  requirement  of  the  system  will 
be  that  she  uses  the  same  response  whenever  the  system  asks  for  her  spouse’s 
name.  In  this  way,  no  person  would  ever  be  required  to  enter  information 
which  he  or  she  regarded  as  a potential  invasion  of  personal  privacy. 

An  additional  advantage  to  this  procedure  would  be  that  a potential 
intruder  could  not  possibly  discover  the  correct  responses  for  any  individual, 
since  no  one  other  than  the  individual  would  know  those  responses.  (It  is 
assumed  that  hardware  storage  devices  and  connecting  cables  are  maintained  in 
a vaulted  area.) 

For  the  purpose  of  cost  comparison  with  other  personnel  varification 
systems,  a relatively  small  computer  terminal  is  described  in  the  attachment. 
The  cost  of  this  equipment  is  in  the  $1,000  to  $2,000  range.  Since  it  incor- 
porates a small  CRT  screen,  which  is  a relatively  expensive  item,  the  cost  of 
this  terminal  may  be  regarded  as  higher  than  that  of  one  which  includes  a less 
sophisticated  form  of  display.  However,  an  advantage  to  this  terminal  is  the 
ability  to  display  complete  instructions  for  the  novice  user,  messages  in  case 
of  user  error,  etc.  In  addition,  since  it  is  rack-mountable,  it  may  be  made 
relatively  secure  against  tampering  by  mounting  it  into  the  wall  of  a passage- 
way near  the  secured  entrance. 

It  is  reasonable  to  estimate  that  time  required  for  the  use  of  this  Q/A 
system  will  be  less  than  30  seconds  for  the  experienced  user  (who  does  not 
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require  initial  instructions  and  is  familiar  with  terminal  operation. ) For 
such  a user,  the  time  involved  will  be  the  time  required  to  type  four  or  five 
words  in  response  to  system  queries. 

It  is  expected  that  the  Q/A  system  will  easily  meet  requirements  for  Type 
I and  Type  II  errors. 

In  estimating  the  probability  that  an  intruder  is  capable  of  guessing  the 
correct  reply  to  a query,  it  is  necessary  to  select  a typical  query;  probabil- 
ities will  vary  somewhat  with  the  type  of  query.  Consider  the  query  MOTHER'S 
FIRST  NAME  ? Webster's  New  World  Dictionary  lists  approximately  400  women's 
names  under  the  heading  "Common  Given  Names,"  without  including  variant 
spellings.  Although  no  distribution  data  is  included,  it  is  reasonable  to 
suppose  that  a person  who  guessed  the  most  common  name  on  the  list  would  have 
no  more  than  1 chance  in  100  of  being  correct.  This  chance  would  be  consider- 
ably reduced  if  users  were  encouraged  to  substitute  mythical  names  for  their 
mothers;  strange  or  exotic  names  would  be  much  more  difficult  to  guess. 

If  n questions  are  asked,  the  probability  of  guessing  all  n questions 
correctly  will  be  100  Thus  the  probability  that  an  unauthorized  intruder 
woula  guess  three  questions  correctly  would  be  lO”^. 

The  likelihood  that  an  authorized  person  will  enter  an  incorrect  response 
is  also  quite  small.  If  the  terminal  is  mounted  in  such  a position  that  only 
tne  user  can  see  the  display,  it  should  be  possible  to  echo  the  user's  entries 
as  they  are  keyed  in.  The  user  will  thus  be  able  to  proofread  his  entry 
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before  entering  it  into  the  system,  which  will  mean  that  typing  errors  will  be 
infrequent.  The  only  possible  source  of  error  will  thus  be  the  result  of  the 
user's  forgetting  the  correct  response.  Since  questions  will  deal  with  very 
familiar  material,  this  likelihood  is  quite  low. 

There  is  an  obvious  risk  that  a person  who  is  cleared  for  a particular 
area  may  reveal  information  to  an  uncleared  person,  thereby  permitting  him  to 
penetrate  the  security  system. 

Although  such  a possiblity  obviously  exists  for  a Q/A  system,  it  is  no 
greater  than  the  risk  that  any  cleared  person  will  reveal  classified  informa- 
tion to  an  unauthorized  person.  The  whole  existence  of  clearance  procedures 
is  founded  upon  the  assumption  that  a cleared  person  will  not  reveal  classi- 
fied information  (within  limits  of  risk  which  are  narrower  as  the  clearance 
level  is  higher). 

It  is  important  to  emphasize  this  point.  If  a person  holding  a security 
clearance  were  to  reveal  the  correct  responses  to  the  Q/A  system  to  an 
unauthorized  person,  he  would  be  guilty  of  revealing  classified  information 
and  would  be  prosecutable  under  appropriate  regulations.  Moreover,  he  would 
be  very  likely  to  be  identified  as  the  guilty  party,  since  only  he  would  have 
known  the  particular  responses  which  were  revealed. 

Under  these  conditions,  the  risk  of  penetration  of  the  Q/A  system  is  no 
greater  than  the  risk  that  any  cleared  person  will  reveal  classified  informa- 
tion to  an  unauthorized  person.  Moreover,  the  risk  that  an  unauthorized 


D-113 


person  will  be  able  to  obtain  the  memorized  responses  to  the  Q/A  system  is 
considerably  lower  than  the  risk  that  he  will  be  able  to  make  voice  recordings. 


to  duplicate  fingerprints,  or  to  obtain  other  surrof’ates  required  to  penetrate 
systems  which  depend  on  physical  characteristics. 


i 
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TYPING  STYLP  - KEY  SEQUENCE  TIMING 


Typical  access  security  methods  often  require  ttie  subject  to  state 
his  ident  ity.  It  seems  quite  reasonable  tliat  the  current  project  will 
do  the  same  and  that  the  statement  will  be  made  via  keyboard  to  be 
machine  accessed. 

The  hypothesis  of  this  proposal  is  that  measurable  differences  in 
the  speeds  which  occur  during  typing  can  be  used  to  verify  the  stated 
identity. 

A primary  advantage  to  this  method  is  that  little  or  no  additional 
hardware  is  required  and  the  software  is  very  simple.  Data  collection 
is  implemented  by  code  which  intercepts  signals  from  the  terminal 
(keyboard)  and  extracts  timing  infoi^mation.  The  signal  is  passed  on  to 
normal  processing  unchanged. 

Pi'eliminary  data  collection  should  require  roughly  1 man/week  to 
implement  and  roughly  1 week  for  collection. 

Preliminary  evaluation: 

1.  Separability  - unknown  until  data  becomes  available.  The  fact 
that  telegraphers  can  bo  distinquished  by  their  particulai’ 
style,  the  so-called  "fist,"  which  must  be  timing 


characteristics  plus  the  recognition  of  personal  cadence  and 


habits  in  typing  supports  an  expectation  of  entirely  sufficient 
separability.  Rate  (tentative)  50. 

2.  Acceptability  - rates  100  if  a statement  of  identity  via 
keyboard  is  assumed.  Perhaps  only  90  if  special  keyboard 
activity  is  required. 

3.  Equipment  - assuming  statement  of  identity,  no  additional 
equipment  should  be  required.  Rates  100. 

4.  Cost  - it  is  not  clear  how  to  give  a relative  rating  to  cost 
here  but,  as  mentioned  in  the  description  of  initial  implemen- 
tation, cost  should  be  quite  low.  Rating  85. 

5.  Speed  - no  delay  is  caused  the  subject.  Analysis  should 
certainly  be  within  3 seconds.  Rating  100. 

6.  Penetrability  - a device  foi'  penetrating  this  method  has 

been  suggested,  an  array  of  solenoids  placed  over  the  keyboard 
and  driven  by  a recording  of  the  proper  person's  activity. 
Rating  50. 

A program  has  been  written  to  run  on  the  PDP  11/45  which  measures 
the  time  delay  between  keystrokes  on  the  console.  This  program  has 
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been  used  to  gather  statistics  which  would  permit  a tentative  evaluation 
of  the  consistency  and  uniqueness  of  an  individual's  typing  style.  It 
was  considered  most  likely  that,  if  any  repeatable  pattern  were  to  exist 
at  all,  it  would  be  most  strongly  displayed  when  the  subject  typed  a 
familiar  character  string  such  as  his  name.  Five  subjects  were  r'equested 
to  type  their  names  and  the  names  of  the  other  individuals  taking  the 
test.  The  I'esults  for  the  typing  of  the  name  "David  Bennett"  by  David 
Bennett  are  tabulated  in  Table  D-8.  The  first  column  of  the  table  gives 
the  adjacent  character  pairs  in  the  name.  The  second  column  gives  the 
time  delay  (units  = 5 milliseconds)  mean  and  standard  deviation  for  the 
subject  on  day  A,  the  second  column  gives  these  numbers  for  David 
Bennett  on  day  B two  weeks  later.  This  data  shows  that  the  pattern  of 
the  subject's  typing  remains  rather  constant  over  two  weeks.  In  Table 
D-9  we  show  the  results  of  an  imposter  typing  the  name  "David  Bennett." 
Finally,  Table  D-10  gives  the  mean  delays  for  five  subjects  typing 
"David  Bennett."  Table  D-10  also  lists  the  standard  deviations  of  the 
subjects  ( inter individual  variation)  multiplied  by  VT  to  convf^r-^  ■)  an 
equivalent  uniform  distribution.  The  between-subject  variation,  u , is 

D 

consistently  larger  than  the  within  subject  variation,  o^.  In  fact,  the 
mean  of  is  4.08.  Assuming  that  there  are  typically  10  character 

pairs  in  a name,  we  compile  the  estimated  Type  I and  II  error  rates 
given  in  Table  D-11.  (Refer  to  Appendix  A). 
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Trials 

of  Day  A 

Trials 

of  Day  B 

Mean 

Standard  Deviation 

Mean 

Standard  Deviation 

DA 

18 

2.82 

20 

1.63 

AV 

42 

8.85 

27 

2.77 

VI 

73 

9.59 

71 

15.26 

ID 

64 

17.3 

55 

3.79 

D_ 

72 

8.2 

61 

11.65 

B 

69 

20.36 

70 

10.21 

BE 

19 

2.28 

23 

4.73 

EN 

90 

37.36 

"3 

20.32 

NN 

32 

2.19 

30 

2.82 

NE 

42 

22.69 

46 

16.  5 

ET 

38 

16.15 

40 

7.9 

TT 

39 

19.69 

26 

2.24 

Table  D-9  Imposter  Tvping  "David  Bennett" 
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Subiect 

1 Subiect  2 

Subiect  3 

Subject  4 

Subject  5 

Vao 

DA 

27 

56 

45 

18 

25 

27.12 

AV 

39 

93 

49 

42 

20 

46.58 

VI 

26 

73 

55 

68 

29 

37.67 

ID 

38 

88 

52 

54 

41 

33.99 

D_ 

52 

120 

36 

72 

83 

55.18 

_B 

57 

136 

106 

83 

46 

63.38 

BE 

47 

67 

55 

19 

20 

36.82 

EN 

32 

121 

62 

90 

25 

69.28 

NN 

29 

48 

27 

32 

31 

14.50 

NE 

40 

73 

38 

42 

28 

29.50 

ET 

43 

83 

45 

38 

26 

37.03 

TT 

31 

45 

35 

39 

33 

9.68 

Table  D-10  Five 

Subjects 

Typing  "David 

Bennett" 

D-121 


tes  for  A = 10  and  oW  = 4.08 
OB 
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LIPS 


Lip  prints  consisting  of  labial  wi’inkles  and  grooves  liavo  been 
divided  into  8 types  by  indiviilual  quailoscopy  for  personal  identifica- 
tion [ll.  Moreover,  there  war.  found  to  be  an  individual  specificity 
in  the  morphology  of  the  lip  g.rooves.  In  a sample  of  107  females,  no 
one  individual  had  the  same  lip  groove  pattci'ii  .as  any  other.  Lip  prints 
were  taken  in  ttie  same  mannci'  as  fingerprints  using  a lipstick  or  othei' 
removable  cosmetic  on  the  lips.  Lip  prints  could  also  be  taken  by 
photography  of  a magnified  TV  camera.  Lip  prints  of  280  individuals  were 
taken  and  found  to  be  different.  Lip  prints  ol  18  pairs  of  unovular 
twins  indicate  that  lip  prints  ot  twins  are  extt'emelv  alike  and  their 
characterist  ics  are  inherited  eithei'  from  the  father  or  mothei'.  A study 
of  lip  prints  over  time  was  being  cari’ied  out  in  1870  but  the  results 
are  not  vet  .ippeai'ed. 

This  method  holds  promise  as  a prime  ecuis  iderat  ion  in  pei'sonal 

t 

/ 

attributes  iiient  i f ic.at  ion . l.if  st  ick  on  women  does  not  prevent  but  is  1 

an  aid  to  it.-;  u:-.e.  The  correlation  of  an  inil  i v idual ' s lip  prints  could 

be  matched  in  .i  .'imilar  m.iniu  r to  f ingt-rprintc..  t'ne  method  may  be  to 

have  e.ich  individual  kic.s  a ele.in  glasc.  plate  (if  weat'ing,  lipstick)  or 

a coated  glac.s  (it  not  wo.tritig  lif-ctick).  Ttu'  comparison  could  then  be 

m.ide  to  his  fih'd  1 ij  print  by  a TV  c.imera  m.ign  i f icat  ion  of  the  new  lip 

print  ■■  .Jga  ins.  t the  original. 
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T'  aivl  in  the  al if^.nmeiit  of  the  lip  pr'ints  and  t Ima  impn.  .e  the 
computer'-a ided  responr.e  time,  a TV  viewer  eould  aid  ttie  individual  in 
alipninp,  his  lip  print  with  the  oi’ip.inal  on  a TV  monitor  ii.sirif^  the 
original  as  a ghost  ovet'lay. 
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D.22.  rnLYi'.KAPH 

The  Lie  Detector  Test  is  only  80%  to  100%  iiccur.ate  depondinp,  on  the 
individuiil  beiny,  tested  nnd  the  opera  l or ' ability  and  questioning 
techniques.  It  measures  broathin)',  blood  pressure,  pulse,  and  sweating. 

The  use  ol  a "truth  serun."  i.  obiect  ionable  as  a drug  since  it  must 
be  injected  slowlv  into  a v'ein  of  a willing  person.  It  is  therefore  not 
considered  for'  the  purposes  ot  this  study. 

The  polygraph  machine,  u-ting  r-espir'at  ion  and  blood  pressure  measure- 
ments, has  attained  an  accuracy  of  verified  diagnoses  (using  the  Reid 
questioning  mt’tiiod  ernj'loying  disguised  and  undisguised  questions)  of  over' 
99%  suece;-..',fu]  . A rii'w  metb.od,  called  the  "silenc  answer  test",  reduces 
defects  caused  by  oral  answerr.  If  the  (ISK  (Tdavanic  Skin  Reflex)  is 
used  with  the  silent  arewer'  [r'oeedure.  the  results  are  enhanced  in 
reJiabilitv  and  accuracy  as  eom[ ared  tt'  using  each  separatelv. 

The  main  objection  to  the  ;olygraph  i"  not  its  accuracy  or  reliability 
but  its  discomfort  factor.  A.-  in  the  case  of  blood  pressure  measurements, 
the  polygraph  requit'es  the  use  of  a blood  pressure  cuff  and  pneumograph 
tube  which  may  c.ruse  a pain  retiction  or  discomfort.  Mcr'eover,  the 
; rocedures  are  t ime-censum  ing  sine.'-  tliev  r-.'quir-'  r.ufticient  questioning 
to  mi.x  control  questions  as  a reference  to  "peak  of  tension"  questions. 
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Body  movements  and  unnecessary  oral  discussion  by  the  subject  have 
disturbing  effects  on  the  tests.  Data  in  4000  cases  is  available. 
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HUMAN  BODY  TRANSFER  FUNCTION 


The  physiological  and  psychological  uniqueness  of  one  person  from  another 
has  probably  always  been  evident  to  man.  From  the  earliest  evidences  of  art 
we  see  a careful  depiction  of  the  variations  in  human  form. 

One  of  the  basic  questions  in  medicine,  for  example,  is  how  does  man  as 
an  individual  respond  to  various  external  stimuli.  For  example,  the  human 
body’s  response  to  vibration.  The  answer  to  that  question  is  just^ beginning 
to  be  realized,  however,  the  essence  of  today's  solutions  goes  back  to 
research  begun  in  1862.  In  that  year  Dr.  Maurice  Raynaud  wrote  an  MD  thesis 
describing  the  symptoms  and  probable  origin  of  a disease  effecting  the  extrem- 
ities. As  he  described  ". . persons,  who  are  normally  females,  see  under  the 
least  stimulus,  sometime  without  appreciable  causes,  one  or  many  fingers 
becoming  pale  and  cold  at  once."  The  disease,  then  known  as  "dead  fingers", 
was  later  given  the  name  Ra>Tiaud's  phenomenon,  and  it  was  at  that  time  thought 
to  be  largely  hereditary  in  origin. 

By  the  end  of  the  nineteenth  century,  other  conditions  giving  rise  to 
Raynaud's  disease  were  recognized.  The  increased  technology  at  the  turn  of 
the  century  allowed  the  production  of  many  new  hand-held  vibrating  tools,  such 
as  the  pneumatic  drill.  The  vibration  induced  by  these  tools  had,  under 
certain  conditions,  effects  similar  to  those  described  by  Dr.  Raynaud.  It  was 
further  found  that  the  disease  tends  to  be  permanent  unless  only  slight  damage 
has  been  inflicted  on  the  fingers. 
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The  level  of  vibration  at  which  damage  is  produced  in  the  hand  as  well  as 
which  causes  general  discomfort  and  loss  of  efficiency  is  difficult  to  deter- 
mine. The  ISO  (International  Organization  for  Standardization)  has  done  much 
to  try  to  determine  what  are  the  acceptable  limits  of  vibration  intensity  and 
duration  with  respect  to  frequency.  Attempts  to  mathematically  predict  how 
man  will  react  to  certain  vibrations  have,  for  the  most  part,  rested  upon  the 
ability  to  accurately  model  the  human  body.  In  particular,  to  model  it  as  a 
linear  discrete  or  continuous  mechanical  system. 


Research  [1]  has  shown  that  for  some  frequencies,  the  human  body  can  be 
modeled  as  a linear,  lumped  parameter  (discrete)  system.  This  is  important 
since  it  now  enables  us  to  apply  much  of  the  well  formulated  linear  systems 
theory  to  the  analysis  of  human  body  response.  Lumped  mechanical  systems  are 
composed  of  springs,  masses  and  dampers.  The  parameters  do  not  vary  with  time 
and  behave  in  a linear  manner.  In  Figure  D-12  there  is  illustrated  a simple 
discrete,  one  degree-of-freedom  system. 


Then,  if  the  system  is  excited  by  a function,  F(t),  it  has  a response, 
x(t),  which  is  completely  determined  by  the  system  characteristics.  If  the 
variables,  F(t)  and  x(t),  are  transferred  from  the  time  or  t domain  to  the  s 
domain  v.  get  (for  initial  conditions  equal  to  zero) 


G(s)  = X(s)/F(s) 
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where  G(s)  is  the  system  transfer  function, 
and  w = radian  frequency)  we  can  re-express 
frequency  as 


Further,  for  s=jw  (where  i=  ^-1 
the  transfer  function  in  terms  of 


G(jw)  = X(jw)/F(jw). 

This  equation  expresses  the  complex  frequency  response  of  the  system  in  terms 
of  the  ratio  of  displacement  to  force.  Expressions,  similar  in  concept  may 
express  system  characteristics  in  terms  of  ratios  of  force-to-velocity  or 
force-to-acceleration.  Hence  in  a real  application  we  may  attach  transducers 
to  body  segments  which  either  measure  displacement,  velocity,  or  acceleration 

An  example  is  offered.  Suppose  a displacement-measuring  transducer  is 
attached  to  an  individual's  arm.  The  arm  would  then  be  excited  by  a sinusoid 
of  varying  frequency;  the  ratio  of  ou'^put  to  input  would  be  recorded,  and  the 
phase  angle  measured.  Then,  with  all  this  necessary  information  given,  the 
transfer  function  for  the  arm  would  be  synthesized.  From  the  following  data 
we  can  construct  a Bode  plot  (Figure  D-13)  from  which  the  transfer  function 
G(s)  can  be  found.  The  slopes  of  the  plot  of  output/input  vs.  frequency  can 
provide  information  as  to  the  type  of  terms  present  in  the  transfer  function. 


W rad/sec 

Output/input  (dE) 

Phase  lag  (between 
output  and  input ) 

.1 

19.9 

-101.2 

.2 

13.6 

-112.3 

.5 

4.08 

-137.0 

0-132 


Bode  Plot 
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rad/sec 


1.0 

-6.02 

-180.0 

2.0 

-20.0 

-223.1 

5.0 

-41.94 

-247.8 

10.0 

0 

o 

1 

-268.7 

From  the  accompanying  Bode  plot  the  following  transfer  function  was  deter- 
mined. 


G(s)  = 5 i 

s(s  + 1.96s  + 1) 

A very  popular  vibration  test,  employed  quite  extensively,  provides 
information  similar  to  that  given  in  the  example.  The  procedure  is  known  as 
the  sweeping  sine  wave  test.  The  individual  to  be  tested,  at  the  security 
area,  would  probably  be  seated  in  a chair  with  his  hand  resting  confortably  on 
a glass  or  metalic  plate  of  known  mass.  A "vibration  machine"  would  then 
excite  the  hand  via  the  plate.  As  the  frequency  of  vibration  was  swept  from 
some  low  limit  to  a high  limit,  the  output  of  the  transducers  coupled  to  the 
plate  and  hand  would  be  recorded.  Then  the  output-to-input  ratio  and  fre- 
quency information  would  be  sent  to  a logic  device.  At  this  point  the  logic 
may  compute  the  transfer  function  and  compare  the  computed  function  to  the 
known,  stored  one,  or  it  may  extract  various  features  from  the  stored  data 
(output,  input,  and  frequency).  One  feature,  for  example,  might  be  the 
location,  in  frequency,  of  resonant  conditions. 
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User  acceptability  of  a vibration-inducing  security  system  will  be 
heavily  influenced  by  the  discomfort  and  apprehension  generated  by  the  vibra- 
tion and  test  equipment.  For  transfer  function  measurements  of  the  hand-arm, 
a plate  and  attached  transducer  could  be  used,  without  requiring  the  user  to 
don  any  electrical  hardware.  This  would  probably  be  acceptable.  The  ampli- 
tude of  vibration  could  be  troublesome  if  it  is  too  large.  This  may  cause 
discomfort.  Testing  would  probably  have  to  be  done  to  determine  what  ampli- 
tudes of  vibration  are  acceptable  to  a wide  range  of  people.  Essentially,  if 
the  hand -arm  system  is  employed,  user  apprehension  and  discomfort  should  be  in 
an  acceptable  range.  User  acceptability  is  rated  90. 

The  effective  implementation  of  any  identification  system  relies  heavily 
on  the  availability  of  the  necessary  measurement  devices.  Equipment  to  be 
used  in  body  transfer  function  measurements  could  essentially  be  selected  from 
"state-of-the-art"  vibration  test  hardware.  Equipment  development  in  vibra- 
tion testing  has  kept  pace  with  the  demands  of  many  fields,  hence,  there  is  a 
wide  assortment  of  highly  accurate,  relatively  inexpensive  hardware  available. 
Most,  if  not  all,  of  the  equipment  needed  in  a body  transfer  function  security 
system  would  be  of  the  "off-the-shelf"  type  so  there  should  be  little  need  for 
any  extensive  equipment  modification  or  development.  This  type  of  security 
system  should  be  technically  very  feasible,  hence,  is  rated  100  in  that  area. 

It  is  a reasonable  assumption  that  the  human  response  to  vibration  will 
be  a function  of  not  only  the  body  characteristics  but  also  of  certain  test 
conditions.  The  variables  involved  may  be  grouped  as  extrinsic  and  intrinsic 
features  depending  on  whether  they  are  characteristic  of  the  vibrational  input 


or  the  human  body.  Some  extrinsic  variables  [2]  affecting  the  vibration 
response  of  the  body  are  the 

1.  Frequency  range  of  vibration 

2.  Amplitude  of  vibration 

3.  Tine  history  of  vibration 

4.  Direction  of  vibration 

5.  Point  of  application  of  vibration 

6.  Interaction  between  the  body  and  vibration  input 

7.  "ffect  of  clothing,  etc. 

The  'nand-ai'm  system,  for  example,  f hculd  be  subjected  to  vibrational  frequen- 
cies that  offer  the  best  opportunity  of  determining  uniqueness  between  indi- 
viduals. M.J.  ^-r  if  fin  [2]  has  stated  that  "It  would  appear  to  be  a reasonable 
proposition  that  resonances  at  higher  frequencies  are  highly  characteristic  of 
an  individual  such  that  even  when  a particular  frequency  has  a significant 
effect  on  one  subject,  there  is  frequently  no  such  overall  effect  for  a group 
of  subjects."  Let  us  pursue  this  observation  further.  One  researcher,  James 
Ott  [3],  has  >atented  an  "individual  identification  apparatus  and  method  using 
frequency  response."  He  has  essentially  used  spectral  information  from  900  Hz 
to  6000  Hz.  To  measure  the  vibrational  response  of  the  hand-arm  he  attaches  a 
transducer  to  the  skin  in  the  immediate  area  of  the  ulna  bone.  This  may  be  a 
source  of  significant  variability  in  the  vibration  measurement  for  as  Suggs 
[4]  has  pointed  out,  "Because  of  the  resiliency  of  the  skinx  and  muscle, 
surface  attachment  of  vibration  transducers  is  not  feasible  except  in  the  low 
frequency  range  (Abranam  and  Suggs,  1969).  For  higher  frequency  observations 
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it  is  desirable  to  attach  transducers  directly  to  the  bone."  It  is  desirable 
to  measure  transmission  through  the  bone  because  it  is  the  most  rigid  tissue 
of  the  arm.  Bone  attachments  are  obviously,  however,  impractical  in  an  iden- 
tification system. 

What  we  are  saying  then  is  that  although  an  individual's  response  to 
vibrational  frequencies  above  900  Hz  (or  so)  may  be  unique,  the  ability  to 
reliably  and  consistently  obtain  this  information  may  be  seriously  impaired  by 
the  inability  to  directly  measure  it. 

The  other  extrinisc  factors  are  important  but  to  some  degree  can  be 
reliably  controlled.  For  example,  the  dynamic  response  of  the  hand-arm  is 

to  be  quite  different  along  different  axes.  However,  we  can  solve  the 
problem  by  measuring  vibration  response  along  only  one  axis  (most  likely  the 
longitudinal ) . 

The  intrinsic  variables  are  probably  most  responsible  for  the  variablity 
in  response  between  individuals.  Some  of  the  more  significant  intrinsic 
factors  are 

1.  Body  size  (weight,  height,  etc.) 

2.  Posture  or  physical  peculiarities  (deformities) 

3.  Body  tension 

Body  posture  would  probably  be  most  influential  in  whole  body  response 
measurements  (not  the  hand-arm).  However,  what  of  body  size?  We  know  that 
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body  size  may,  in  whole  body  tests  especially,  effect  the  dynamic  character- 
istics of  the  vibration  source,  but  for  the  hand-arm,  this  type  of  effect 
shouJ.d  not  be  significant.  What  body  size  may  be  most  indicative  of  is  the 
mass  of  the  bone,  muscle  and  other  tissue  for  each  individual.  Hence,  because 
these  components  of  the  body  will,  to  some  degree,  always  be  unique  to  each 
person,  the  response  of  the  hand-arm,  for  example,  should  be  somewhat  unique 
for  each  subject.  Zaveri  and  Phil  [5]  have  shown  the  response  characteristics 
cf  two  people  to  be  uniquely  different.  One  person  weighed  55  kg  and  the 
other  80  kg  and  both  were  subjected  to  the  same  test  conditions. 

Body  tension  can  also  effect  the  transmission  of  vibration  to  the  body. 
For  example,  tests  [5]  conducted  in  which  subjects  were  required  to  hold  a 
vibrating  handle  showed  that  the  amount  of  grip  pressure  was  directly  related 
to  the  force  transmitted  through  the  arm.  For  tests  measuring  mechanical 
impedance  (force/velocity),  there  was  an  increase  in  the  impedance  for  higher 
grip  forces. 

In  conclusion,  the  dynamic  response  characteristics  of  the  hand-arm  or, 
for  that  fact,  body  segments  in  general  are  probably  dependant  on  the  basic 
psysiological  characteristics  of  the  individual  as  well  as  the  psychological 
factors  which  can  influence  them.  The  masses  of  individual  arms  will  be 
different;  subjects  will  on  any  given  day  be  tense  or  relaxed,  or  the  muscles 
nay  be  stretched  or  bunched  from  some  previous  physical  activity.  Hence, 
there  are  many  very  important  and  influential  factors  effecting  the  reliabil- 
ity with  which  a security  system,  using  body  transfer  function  information, 
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can  operate  at.  There  is  no  available  information  nor  data  available  in 
sufficient  quantity  which  would  enable  us  to  predict  either  the  Type  I or  II 
error  rates.  For  separability,  we  rate  the  attribute  60,  primarily  because  of 
the  degree  of  variablity  which  the  user  can  input  to  the  system. 
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D.24.  FINGERNAIL  AND  TOENAIL  STRIATIONS 


The  examination  of  nail  samples  has  been  shown  to  be  an  important 
criminological  tool  in  recent  years.  Like  the  patterned  "friction  skin" 
of  the  hands  and  feet,  the  longitudinal  striations  (grooves)  of  the  nails 
apparently  do  not  change  with  age,  and  in  many  criminal  cases  have 
afforded  a means  of  establishing  the  guilt  or  innocence  of  a suspect  [1,2]. 
However,  permanent  disfigurement  of  the  nails  can  result  from  a serious 
injury  or  disease.  The  striation  process  is  caused  by  the  nails  being 
"extruded"  over  parallel  ridges  on  the  nail  bed  during  growth.  These 
ridges  are  sufficiently  numerous  and  randomly  distributed  to  preclude 
the  existence  of  two  identical  striation  patterns,  thus  providing  a 
means  of  personal  identification.  Fingernail  samples  acquired  from  the 
same  subject  over  a period  of  ten  years  did  not  show  any  marked 
variation  [2]. 

Inasmuch  as  the  striations  of  the  lower,  concave  surfaces  of  the 
nails  are  more  pronounced  than  those  observed  in  vivo,  known  studies 
have  required  the  removal  of  at  least  a portion  of  the  nail,  usually 
a clipping.  The  undersides  of  specimens  are  preferred  also  because  they 
are  somewhat  protected  from  damaging  wear  and  injury  during  their 
lifetime.  On  the  average,  the  spacing  of  the  striations  is  of  the 
order  of  .1  mm,  so  that  approximately  100  lines  per  nail  are  available 
for  comparison  [3]. 
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Three  methods  of  preparing  specimens  are  currently  in  use.  The 
first  involves  simply  flattening  them  in  a press  after  cleaning.  Two 
nails  at  a time  are  then  viewed  under  a comparison  microscope  at  24-52 
times  magnification.  The  second  method  is  designed  to  increase  the 
resolution  through  the  use  of  a metalizing  step  that  dramatically 
improves  the  contrast  between  the  striations  when  examined  by  microscope. 
The  third  method  produces  color  images  of  nails  placed  between  two 
sheets  of  crossed  linear  polarized  material  and  observed  under  a comparison 
microscope.  No  known  techniques  for  studying  the  nails  in  vivo  have  been 
developed . 

The  prospects  for  establishing  a personal  identification  system 
based  on  the  nails,  preferably  the  fingernails,  appear  to  be  promising, 
provided  that  a suitable  means  of  measuring  the  striations  be  devised. 

This  might  entail  applying  a temporary  coating  to  the  nail  as  part  of  a 
photographic  technique,  or  developing  a highly  sensitive  transducer  for 
detecting  the  occurrence  of  the  striation  peaks.  Such  an  instrument 
couLd  then  bo  used  to  examine  a nail  in  much  the  same  manner  as  a UPC 
reader  scans  a bar  code. 

All  'rilngly,  the  technological  feasibility  of  measuring  nail 
striations  has  been  assigned  a score  of  60.  The  separability  and 
ident  i ; icrit  i‘jn  spe'_  i are  each  worth  100  points,  but  less  than  total 
c »■  i!  ‘lity  of  rhe  r.ystem  could  be  anticipated,  since  women  users 
would  be  prohibited  from  applying  nail  polish.  Also,  the  possibility  of 
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an  intruder  wearing  counterfeit  or  stolen  nails  would  render  the  system 
vulnerable  to  penetration. 

In  summary,  nail  striations  appear  to  offer  an  attractive  alternative 
to  presently  accepted  criteria  for  personal  identifications.  But  because 
it  is  not  feasible  for  clippings  to  be  taken  each  time  a subject  is  to 
be  screened,  current  methods  of  analysis  are  inadequate.  It  is  felt 
that  further  research  is  needed  to  ascertain  the  viability  of  a personal 
identification  system  based  on  the  nails. 
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ULTRASONICS  FOR  HAND  BONE  STRUCTURE 


The  arrangement  of  bones  in  the  hand  can  be  observed  easily  via 
x-rays.  Ultrasonic  techniques  coupled  with  laser  imaging  have  been  used 
to  see  fine  skeletal  detail  in  a living  fish  [1],  Be  replacing  the 
optical  imaging  arrangement  with  an  array  of  ultrasonic  sensors,  an 
arbitrarily  fine  digital  image  (up  to  sonic  wavelength  resolution)  should 
be  produced. 

The  primary  feature  measured  is  the  relative  locations  of  finger 

joints  because  they  are  fairly  regular  and  will  show  up  more  clearly  than 

I 

f other  features.  Features  such  as  shapes  of  finger  bones,  placement  of  ^ 

palm  or  wrist  bones  all  involve  much  more  complexity  and  potential 
interference  than  just  fingers  and  so  would  be  ignored. 

Preliminary  evaluation: 

1.  Separability  - the  variations  in  the  measured  feature  are  seen 
to  be  rich  by  simple  observation  so  separability  should  be 
adequate  even  after  the  requisite  data  scaling  and  orientation. 

2.  Acceptability  - the  subject  will  get  a wet  hand  or  will  have  to 
insert  the  hand  into  a possibly  threatening  device.  It  is 
possible  that  he  will  heap  noise  indicating  ultrasonic  activity 
which  may  also  be  a deterrent. 
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3.  Equipment  - no  complete  device  as  i'(^quired  here  is  known  to 
be  readily  available  but  all  necess^iry  components  are  either 
"off-the-shelf"  or  easily  constructed. 


Cost  - a nearly  complete  outfit  is  required,  at  least  in  proto- 
type form,  even  to  gather  Phase  II  data.  Since  this  is  con- 
sidered a development  cost,  this  factor  rates  about  30. 


Speed  - Rates  95.  Digitization  of  the  sensor  output,  scaling, 
orientation,  and  filtering  (to  leave  only  joint  locations) 
should  be  on  the  or ’.er  of  milliseconds.  In  all,  12  items 
of  numeric  data  will  then  be  compared  to  the  data  base.  Time 
should  be  well  within  10  seconds  even  for  a larger  installation. 


Penetrability  - duplication,  to  the  expected  resolution  of  this 
system,  of  the  internal  structure  of  a particular  person's 
hand  would  be  especially  costly  and  difficult  for  an  adversary 
so  the  rating  is  about  80. 
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CARDIOGRAMS  OF  SUBJECT  A 
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Cardiograms  of  Thirty  Subjects 
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APPENDIX  H 


TOWARD  AN  AUTOMATIC  EXTRACTION  OF 
HANDPRINT  MEASUREMENTS 

Measurements  extracted  from  hand  geometry  (creases  on  fingers  and 
palm)  indicate  significant  potential  for  a solution  to  the  identity  veri- 
fication problem.  The  bulk  of  the  effort  in  this  area  to  date  has  consisted 
of  analysis  of  hand  geometry,  selection  of  candidate  descriptors,  manual 
digitization  of  descriptor  measurements , and  the  design  and  evaluation  of 
classification  logic  based  on  these  measurements.  Classification  logic 
performance  has  been  excellent  as  described  in  subsection  4.1  of  this 
report . 

It  remains  to  demonstrate  the  capability  to  extract  hand  geometry 
measurements  efficiently  using  automatic  techniques.  During  this  effort, 
it  was  assumed  that  the  most  cost-effective  approach  was  to  determine  the 
value  of  the  handprint  features  for  automatic  personnel  verification. 

This  allowed  for  the  evaluation  of  the  potential  of  hand  prints  without 
excessive  expenditures  for  the  development  of  a measurement  extraction 
device,  as  no  off-the-shelf  hardware  is  directly  applicable.  Although 
the  complete  design  of  fully  automatic  hardware  for  handprint  feature 
extraction  was  outside  the  scope  of  this  effort,  some  preliminary  in- 
vestigations have  been  made  as  detailed  below. 

Experimentation  was  performed  using  digital  processing  algorithms 
available  on  the  RADC  Image  Processing  System  (also  known  as  DICIFER). 


H-1 


One  subject's  fingers  were  digitized  (at  8 bits  grey  lov-'l  per  pixel)  via 
the  on-line  Computer  Eye  vidicon  camera  and  stored  as  an  image  file 
(512  X 512  pixels)  on  the  RP(>2  dislt.  Spatial  resolution  was  such  that 
valleys,  ridges,  and  minutiae  were  visible  in  the  digital  image  wfien 
viewed  on  the  system's  TV  display.  Secondly,  the  imtge  was  processed  with 
a low-j ass  spatial  filter  using  the  "Weighted-Smooth"  algorithm  on 
DICIKER.  The  net  effect  was  a suppression  of  the  "high-frequency"  detail 
of  the  fine  minutiae  without  obscuring  the  thicker  line  structure  due  to 
the  flexion  creases. 

The  next  step  was  to  automatically  extract  the  crease  lines  and  the 
outside  boundaries  of  the  fingers.  A picture  gradient  process  was 
utilized  to  extract  the  boundaries.  This  result  was  transformed  by 
thresholding  to  the  binary  image  in  Figure  H-1.  Indications  are  that 
with  the  proper  lighting  and  with  firm  positioning  of  the  subject  hand 
through  the  use  of  a properly  designed  jig  that  such  a gradient  process 
could  be  implemented  for  the  automatic  extraction  of  handprint  features. 

It  is  recommended  that  additional  processing  of  handprint  data  be 
performed  using  the  RADC  Image  Processing  System  in  Phase  I to  determine 
system  design  and  parameters  and  in  Phase  II  to  implement  a test  bed 
veT'i f icat i 5n  .'.f'vic^'. 


H-2 


Figure  H-1  Digitized  and  Processed  Image  of 
Three  Fingers  of  Right  Hand 
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RADC  plans  and  conducts  research,  exploratory  and  advanced 
development  programs  in  command,  control,  and  connanications 
(C^)  activities,  and  in  the  areas  of  information  sciences 
and  intelligence.  The  principal  technical  mission  areas 
are  communications,  electromagnetic  guidance  and  control, 
surveillance  of  ground  and  aerospace  objects,  intelligence 
data  collection  and  handling,  information  system  technology, 
ionospheric  propagation,  solid  state  sciences,  micromave 
physics  and  electronic  reliability,  maintainability  and 
compatibility . 


